Microsoft Releases Updates to Patch Critical Flaws in Windows and Other Software

Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft SharePoint Server contains a privilege escalation flaw (CWE-303, incorrect implementation of an authentication algorithm) in which an attacker can forge (spoof) JSON Web Token (JWT) authentication tokens that the server accepts as valid. An unauthenticated remote attacker who presents such spoofed tokens bypasses authentication entirely and gains administrator privileges on the affected SharePoint deployment. Organizations running on-premises Microsoft SharePoint Server are affected, including both internet-facing and internally hosted servers. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-10 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. No public proof-of-concept is catalogued, but the KEV listing and perfect EPSS score make urgent patching critical.

Do: Apply Microsoft's SharePoint Server security updates immediately (the fix shipped in Microsoft's March 2023 Patch Tuesday updates for supported SharePoint Server versions), consistent with the CISA KEV required action. Until patched, restrict internet exposure of SharePoint servers and review authentication logs for anomalous or spoofed-token activity, hunting for signs of compromise given known ransomware use. If mitigations are unavailable, CISA advises discontinuing use of the product.

Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability

CVE-2023-3079 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine that powers Google Chromium, triggerable remotely when a user visits or is directed to a specially crafted HTML page. Successful exploitation causes heap corruption, which a remote attacker can leverage to execute code within the affected browser's renderer process. Every browser or application built on the Chromium engine is potentially affected, explicitly including Google Chrome, Microsoft Edge, and Opera. The flaw is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-06-07 with a required action to apply vendor updates, and EPSS assigns a 32.1% probability of exploitation activity in the next 30 days (98th percentile). No public proof-of-concept code is known, but the KEV listing confirms real-world attacks, making rapid patching of all Chromium-based browsers a priority.

Do: Immediately update Google Chrome, Microsoft Edge, Opera, and any other Chromium-based browsers (including Chromium-embedded applications) to the latest vendor release, per the CISA KEV required action to apply updates per vendor instructions; confirm the update applied via the browser's About/Settings page. As a stopgap where patching is delayed, restrict browsing to trusted sites or disable JavaScript where feasible, since exploitation requires the renderer to process a crafted HTML page.