Microsoft Patch Tuesday for July 2021 — Snort rules and prominent vulnerabilities

CVE-2021-33771 is a high-severity (CVSS 3.1: 7.8) elevation-of-privilege flaw in the Windows kernel that allows a low-privileged user who can already execute code on a local machine to escalate to kernel-level (SYSTEM) privileges, with high impact on confidentiality, integrity and availability and no user interaction required. It is triggered locally, for example by running a malicious process or planted component on an affected system, and because it grants full SYSTEM rights it is typically chained with another flaw (such as a browser or document exploit) to escape a sandbox or complete an intrusion. Affected products span every mainstream Windows release current at disclosure: Windows 10 versions 1507, 1607, 1809, 1909, 2004, 20H2 and 21H1, Windows 8.1 and Windows RT 8.1, and Windows Server 2004, 2012 and 2016. The flaw was exploited before a patch existed; it was fixed in Microsoft's July 2021 Patch Tuesday (reported as 117 flaws including 9 zero-days, 4 actively exploited) and was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, with EPSS in the 95th percentile (~10% probability of exploitation within 30 days). Related coverage links the Windows zero-days patched in July 2021 to spyware operations by the Israeli surveillance vendor Candiru targeting journalists and activists, indicating targeted in-the-wild use rather than mass commodity exploitation.

Do: Apply Microsoft's July 2021 (or later) cumulative security updates to all affected Windows 10, 8.1, RT 8.1 and Windows Server hosts and verify the kernel update is installed, prioritizing KEV-driven remediation. Given the reported use in targeted spyware campaigns against journalists and activists, hunt on systems that ran unpatched builds for signs of compromise, such as unexpected process creation by low-privileged users, novel persistence, or unusual outbound traffic.

Windows DNS Server Remote Code Execution Vulnerability

CVE-2021-34448 is a memory corruption flaw (out-of-bounds write, CWE-787) in Microsoft's Windows Scripting Engine, the component that executes scripts such as JScript and VBScript on Windows. It is triggered when the engine mishandles objects in memory while processing crafted script content, typically through user interaction such as viewing a malicious web page or opening a document containing crafted script. Successful exploitation can corrupt memory in a way that lets an attacker execute code in the context of the current user, giving the attacker the victim's privileges on the machine. Essentially every Windows client and server ships the scripting engine, so the affected population is effectively all unpatched Microsoft Windows systems; exploitation is confirmed in the wild, with CISA adding the flaw to its KEV catalog on 2021-11-03 and an unusually high EPSS of 40.1% (99th percentile) indicating elevated near-term exploitation risk, though no ransomware association is confirmed and no public proof-of-concept is known. Remediation is through the vendor's Windows security updates addressing this CVE.

Do: Apply the Microsoft Windows security updates that fix CVE-2021-34448 (delivered via Windows Update in Microsoft's November 2021 release cycle) to all Windows clients and servers, prioritizing endpoints used interactively for web browsing and document handling, as CISA KEV requires prompt federal remediation. Verify each system's installed cumulative update includes the fix for this CVE before treating it as remediated. Until patched, reduce risk by limiting exposure to untrusted web content and documents (e.g., minimizing use of legacy Internet Explorer and scripting hosts) and monitor for suspicious activity involving Windows scripting components.

Win32k Elevation of Privilege Vulnerability

Microsoft Defender Remote Code Execution Vulnerability

Microsoft SharePoint Server Remote Code Execution Vulnerability

Microsoft SharePoint Server Remote Code Execution Vulnerability

Microsoft Exchange Server contains a server-side request forgery (SSRF, CWE-918) in the Autodiscover service that unauthenticated remote attackers can reach over HTTP. This flaw is the first stage of the widely documented 'ProxyShell' chain, in which the SSRF is combined with privilege escalation and an arbitrary file write in the Exchange PowerShell backend to achieve unauthenticated remote code execution on the server. An attacker who successfully exploits it gains the ability to run code on the Exchange server, and ransomware operators (e.g., Cuba ransomware) leveraged this chain to deploy payloads. Organizations running on-premises Microsoft Exchange Server (2013, 2016, and 2019 per the vendor's advisories) are affected; hosted Exchange Online is a separately managed cloud service. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days (100th percentile).

Do: Apply Microsoft's July 2021 (or later) Exchange Server security updates, which include the ProxyShell fixes, to all on-premises servers. If patching is delayed, restrict internet access to the Autodiscover/EWS frontend endpoints and consider the URL Rewrite mitigation Microsoft published for ProxyShell. Given the KEV listing and known ransomware use, treat internet-facing, unpatched Exchange servers as potentially compromised and hunt for webshells, unusual Exchange processes, and suspicious account or mailbox activity.