It’s May already and everyone is looking towards Microsoft, in hopes that some of the flaws they’ve been struggling with will finally get fixed.

We’ve already provided the direct download links for the cumulative updates released today for Windows 10 and 11, but now it’s time to talk about Critical Vulnerabilities and Exposures again.

This month, the Redmond tech giant released 38 new patches, which is a lot less than some people were expecting right after Easter.

These software updates address CVEs in:

• Microsoft Windows and Windows Components
• .NET and Visual Studio
• Microsoft Edge (Chromium-based)
• Microsoft Exchange Server
• Office and Office Components
• Windows Hyper-V
• Windows Authentication Methods
• BitLocker
• Windows Cluster Shared Volume (CSV)
• Remote Desktop Client
• Windows Network File System
• NTFS
• Windows Point-to-Point Tunneling Protocol

For May, Microsoft only released 38 new patches, which is still a lot less than some people were expecting for the fifth month of 2023.

One of Microsoft’s lightest months with only 38 updates

Not the busiest but also not the lightest month for Microsoft security experts, so we can relax a bit right before the summer.

You might like to know that, out of the 38 new CVEs released, seven are rated Critical and 31 are rated Important in severity.

As many of you probably already know, May is always a smaller month for fixes historically, but this month’s volume is the lowest since August 2021.

Know that one of the new CVEs is listed as under active attack and two are listed as publicly known at the time of release.

Let’s take a closer look at CVE-2023-29336, as its the one bug listed as being under active attack at the time of release.

Thus, as a result, you must go all the way back to May of last year before you find a month where there wasn’t at least one Microsoft bug under active attack.

In fact, this type of privilege escalation is usually combined with a code execution bug to spread malware, so we advise caution.

Moving on to CVE-2023-29325, we learn that while the title says OLE when it comes to this bug, the real component to worry about is Outlook.

Please note that this vulnerability allows an attacker to execute their code on an affected system by sending a specially crafted RTF e-mail.

The Preview Pane is an attack vector, so a target doesn’t even need to read the crafted message, and while Outlook is the more likely exploit vector, other Office applications are also impacted.

Microsoft mentioned that this is one of the publicly known bugs patched this month and has been widely discussed on Twitter.

CVE-2023-24941 has been given a CVSS of 9.8 and allows a remote, unauthenticated attacker to run arbitrary code on an affected system with elevated privileges.

And, the worst part is that no user interaction is required. Another interesting thing about this vulnerability is that exists in NFS version 4.1 but not versions NFSv2.0 or NFSv3.0.

Rest assured that you can mitigate this bug by downgrading to a previous version, but Microsoft warns that you should not use this mitigation unless you have the CVE-2022-26937 patch from May 2022 installed.

Observing the remaining Critical-rated patches, there’s another CVSS 9.8 bug in Pragmatic General Multicast (PGM) that looks identical to PGM bug patched last month.

It’s important to know that this could indicate a failed patch or, more likely, a wide attack surface in PGM that is just starting to be explored.

There are also patches for Critical-rated bugs in the LDAP and SSTP protocols and an intriguing bug in MSHTML that could allow a remote attacker to escalate to administrator privileges.

The Redmond tech giant doesn’t provide details here, but they do note some level of privileges is required.

The next Patch Tuesday rollout will be on May 10th, so don’t get too comfortable with the current state of affairs, as it might change sooner than you think.

Was this article helpful to you? Share your opinion in the comments section below.

Yes, you guessed it! The third round of the monthly Patch Tuesday updates of 2023 have arrived, and they bring an entire array of changes for both Windows 10 and Windows 11, regardless of whether it is a newer or an older version.

As we announced earlier today, the May 2023 Patch Tuesday updates are expected to fix some of the issues that were still pending, and in the article below we will be looking to see exactly what we get.

We’ve included detailed changelogs for each cumulative update, and we will also be providing you with direct download links from Microsoft’s Windows Update Catalog, so you know that they are secure.

Alternatively, you can always use other methods to get the latest updates, including:

• The Windows Update menu on your OS
• The WSUS (Windows Server Update Service)
• Group Policies set up by your admins if you’re part of a larger network.

Changes included in the May Patch Tuesday Updates

Windows 11

As most of you know by now, Microsoft released its latest operating system, Windows 11, on the 5th of October, 2021.

Five months after the general rollout, the new OS seems to become increasingly stable and far less buggy than we’ve gotten used to.

You might also like to know that the 22H2 version of Windows 11, the operating system’s first major update, has already been declared feature complete.

It will, most likely, come in the first half of the year, so we might just get it until the summer. Of course, there is a possibility that the Redmond tech giant could postpone to the third, or fourth quarter.

Cumulative update name

KB5026368

Improvements and fixes

• This update addresses a race condition in Windows Local Administrator Password Solution (LAPS). The Local Security Authority Subsystem Service (LSASS) might stop responding. This occurs when the system processes multiple local account operations at the same time. The access violation error code is 0xc0000005.

Known issues

• After installing this or later updates, Windows devices with some third-party UI customization apps might not start up. These third-party apps might cause errors with explorer.exe that might repeat multiple times in a loop. The known affected third-party UI customization apps are ExplorerPatcher and StartAllBack. These types of apps often use unsupported methods to achieve their customization and as a result can have unintended results on your Windows device.

[DIRECT DOWNLOAD LINK]

Windows 10 versions 21H2, 21H1, and 20H2

Windows 10 v21H2 is the latest major version of Windows 10, and as such has the most experimental features on it.

Fortunately, most bugs that were first present when it was first made available have been weeded out, and this version of Windows 10 is far more stable.

Cumulative update name

KB5026361 

Improvements

• This update addresses a race condition in Windows Local Administrator Password Solution (LAPS). The Local Security Authority Subsystem Service (LSASS) might stop responding. This occurs when the system processes multiple local account operations at the same time. The access violation error code is 0xc0000005.

Known issues

• Devices with Windows installations created from custom offline media or custom ISO image might have Microsoft Edge Legacy removed by this update, but not automatically replaced by the new Microsoft Edge. This issue is only encountered when custom offline media or ISO images are created by slipstreaming this update into the image without having first installed the standalone servicing stack update (SSU) released March 29, 2021 or later.

NOTE

Devices that connect directly to Windows Update to receive updates are not affected. This includes devices using Windows Update for Business. Any device connecting to Windows Update should always receive the latest versions of the SSU and latest cumulative update (LCU) without any extra steps. 

[DIRECT DOWNLOAD LINK]

Windows 10, version 1809

This version of the OS is outdated and will no longer receive any updates from the tech company. Users that are still running this old version on their devices are strongly advised to choose a more recent one to update to.

If you still want to use Windows 10 and are not willing to upgrade to 11, you don’t have to do so right away. After all, Microsoft announced that the support for Windows 10 will go on until 2025.

Cumulative update name

KB5026362 

Improvements and fixes:

• This update addresses an issue that affects conhost.exe. It stops responding.  
• This update affects the Islamic Republic of Iran. The update supports the government’s daylight saving time change order from 2022.
• The update addresses an issue that affects the Remote Procedure Call Service (RPCSS). A lock order inversion causes a deadlock in it.
• This update addresses an issue that affects the Key Distribution Center (KDC) service. When the service stops on a local machine, signing in to all local Kerberos fails. The error is STATUS_NETLOGON_NOT_STARTED.
• This update addresses an issue that affects accounts that run the Set-AdfsCertificate command. The command fails. This occurs when an account does not have read permissions for the related Distributed Key Manager (DKM) container.
• This update addresses an Active Directory Federation Services (AD FS). You might need to retry authentication multiple times to sign in successfully.
• This update addresses an issue that affects SMB Direct. Endpoints might not be available on systems that use multi-byte character sets.
• This update addresses an issue that might affect the Windows Local Administrator Password Solution (LAPS). It might fail. This occurs on versions of Windows Server 2019 that run Server Core. The error is 0x8007007f.
• This update addresses an issue that affects apps that use DirectX on older Intel graphics drivers. You might receive an error from apphelp.dll.
• This update addresses a race condition in Windows LAPS. The Local Security Authority Subsystem Service (LSASS) might stop responding. This occurs when the system processes multiple local account operations at the same time. The access violation error code is 0xc0000005.
• This update addresses an issue that affects the legacy Local Administrator Password Solution (LAPS) and the new Windows LAPS feature. They fail to manage the configured local account password. This occurs when you install the legacy LAPS .msi file after you have installed the April 11, 2023, Windows update on machines that have a legacy LAPS policy. 

Known issues

• After installing KB5001342 or later, the Cluster Service might fail to start because a Cluster Network Driver is not found.
• After installing updates released January 10, 2023, and later, kiosk device profiles that have auto log on enabled might not sign in automatically. After Autopilot completes provisioning, affected devices will stay on the sign-in screen prompting for credentials.

[DIRECT DOWNLOAD LINK]

Windows 10, version 1607

Windows 10, version 1607 has reached the end of service for all of its available editions. Update to the latest version of Windows 10 in order to keep your system protected.

Cumulative update name

KB5026363 

Improvements and fixes

• This update affects the Islamic Republic of Iran. The update supports the government’s daylight saving time change order from 2022.
• This update addresses an issue that affects the Key Distribution Center (KDC) service. When the service stops on a local machine, signing in to all local Kerberos fails. The error is STATUS_NETLOGON_NOT_STARTED.
• This update addresses an issue that affects Microsoft Edge IE mode. The issue stops you from configuring add-ons.

[DIRECT DOWNLOAD LINK]

Windows 8.1

Although considered obsolete, there are still many users that choose to stick with good old Windows 8.1, for different reasons.

Due to this, Microsoft has continued to provide security updates for this old version of the operating system.

During this Patch Tuesday rollout, the Redmond-based tech giant did not forget about the OS and has released yet another security patch.

Cumulative update name

KB5026415 

Improvements and fixes

• By order of the Islamic Republic of Iran on September 22, 2022, daylight saving time (DST) will no longer be observed and the republic will remain on Iran Standard Time UTC+03:30.
• Local Kerberos authentication fails if the local Key Distribution Center (KDC) service is stopped. Additionally, all local Kerberos logons fail with the error STATUS_NETLOGON_NOT_STARTED.
• After the Windows Monthly Rollup dated on or after November 8, 2022, is installed, Kerberos constrained delegation (KCD) fails with the error message KRB_AP_ERR_MODIFIED on Read/Write Domain Controllers.

[DIRECT DOWNLOAD LINNK]

Windows 7 SP1

Maybe some of you might have forgotten about the veteran on this list, but Microsoft sure hasn’t done so, at least yet.

There are still too many users on this old operating system for the company to simply put it in the back of its head and pay it no attention.

And yes, the May 2022 Patch Tuesday rollout brings another security update for Windows 7 SP1. Let’s see what this is all about.

Cumulative update name

KB5026413 

Changes and improvements

• By order of the Islamic Republic of Iran on September 22, 2022, daylight saving time (DST) will no longer be observed and the republic will remain on Iran Standard Time UTC+03:30.
• After the Windows Monthly Rollup dated on or after November 8, 2022, is installed, Kerberos constrained delegation (KCD) fails with the error message KRB_AP_ERR_MODIFIED on Read/Write Domain Controllers.

Known issues

• After installing this update and restarting your device, you might receive the error, “Failure to configure Windows updates. Reverting Changes. Do not turn off your computer”, and the update might show as Failed in Update History.

[DIRECT DOWNLOAD LINK]

This wraps up our brief overview of this month’s Patch Tuesday updates, and we hope that by reading the changelogs above, you will make a more informed decision regarding whether to update or not.

However, keep in mind that if you choose not to update for too long, you will risk exposing yourself to subsequent malware attacks that usually follow the Patch Tuesday updates, called Exploit Wednesday.

On that note, if you do prefer to wait out until Microsoft fixes the issues detected in this month’s updates, know that you can always choose to delay the Update notification that you get for up to 35 days.

All in all, it is important to remember that the Patch Tuesday updates are released for a reason, so installing them, eventually, is something that you should do.

Have you already downloaded the security updates for your version of the Windows operating system? Let us know in the comments section below.