Microsoft Patch Tuesday fixes three flaws actively exploited in attacks in the wild

A remote code execution vulnerability in Microsoft Edge exists in the way that the Scripting Engine renders when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0201.

A remote code execution vulnerability exists when Windows Hyper-V Network Switch running on a host server fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Remote Code Execution Vulnerability." This CVE ID is unique from CVE-2017-0162, CVE-2017-0163, and CVE-2017-0181.

CVE-2017-0199 is a remote code execution vulnerability in Microsoft Office and WordPad that stems from improper parsing of specially crafted files. Attackers trigger it by getting a user to open a malicious document, after which attacker-controlled code executes with the privileges of the logged-in user. Anyone running the affected Microsoft Office or WordPad software is exposed, and CISA notes the flaw has been leveraged in ransomware campaigns; no CVSS score is available in the source data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, and EPSS assigns a 99.9% probability of exploitation within 30 days (100th percentile), indicating active, ongoing exploitation.

Do: Apply Microsoft's security updates for Office and Windows per vendor instructions, as required by CISA's KEV catalog; the flaw was publicly reported as fixed in Microsoft's April 2017 security updates. Until patched, treat unsolicited Office documents and email attachments as high-risk, since exploitation requires a user to open a crafted file. Verify that all Office and WordPad installations across the estate—especially endpoints that handle untrusted documents—have received the update.

CVE-2017-0210 is a privilege elevation flaw caused by Internet Explorer failing to properly enforce cross-domain policies, breaking the isolation between security zones/domains in the browser. It is triggered when a user views malicious or attacker-controlled web content in Internet Explorer, allowing content from one domain to reach resources that should be restricted to another domain or zone. Successful exploitation lets an attacker access information across those boundaries and gain elevated privileges within the browser context, which is commonly chained with other flaws for fuller compromise. Any user running affected versions of Internet Explorer on Windows is affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-05-24), indicating known exploitation in the wild, with a 22.3% EPSS probability of exploitation in the next 30 days (98th percentile).

Do: Apply Microsoft security updates per vendor instructions (the latest cumulative Internet Explorer security updates on all supported Windows versions still in use), since CISA's required action is to apply updates. Audit your environment for systems still launching IE or embedded WebBrowser/IE-based content, restrict or retire IE usage, and migrate users to a supported modern browser (e.g., Edge, using IE mode only for legacy intranet apps) to reduce exposure.

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-1000362. Reason: This candidate is a duplicate of CVE-2017-1000362. A vendor reference identifier was mistakenly treated as a CVE ID. Notes: All CVE users should reference CVE-2017-1000362 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage