With September's Patch Tuesday Updates Microsoft fixed 79 flaws, including 4-zero day CVEs

Microsoft has released its September 2024 Patch Tuesday updates, which fix 79 flaws, including four actively exploited and one publicly disclosed zero-day vulnerability, seven of which are critical. The vulnerabilities include Elevation of Privilege, Security Feature Bypass, Remote Code Execution, Information Disclosure, Denial of Service, and Spoofing.

• 30 Elevation of Privilege vulnerabilities
• 23 Remote Code Execution vulnerabilities
• 11 Information Disclosure vulnerabilities
• 8 Denial of Service vulnerabilities
• 4 Security Feature Bypass vulnerabilities
• 3 Spoofing vulnerabilities

The four actively exploited vulnerabilities included:

CVE-2024-38014 – Windows Installer Elevation of Privilege Vulnerability with a CVSS score of 7.8 allowed attackers to gain SYSTEM privileges on Windows systems. Microsoft has not shared any details on how it was exploited in attacks.

CVE-2024-38217 – Windows Mark of the Web Security Feature Bypass Vulnerability with a CVSS score of 7.5, publicly disclosed this flaw last month, and it is believed to have been actively exploited since 2018.

CVE-2024-38226 – Microsoft Publisher Security Feature Bypass Vulnerability with a CVSS score of 7.8, bypassing the security protections against embedded macros in downloaded documents.

CVE-2024-43491 – Microsoft Windows Update Remote Code Execution Vulnerability with a CVSS score of 7.8, which only impacts Windows 10, version 1507, which reached the end of life in 2017.

The last one also impacts Windows 10 Enterprise 2015 LTSB and Windows 10 IoT Enterprise 2015 LTSB editions, which are still under support.

This flaw caused Optional Components, such as Active Directory Lightweight Directory Services, XPS Viewer, Internet Explorer 11, LPD Print Service, IIS, and Windows Media Player to roll back to their original RTM versions. Any previous CVE could be reintroduced into the program, which posed a huge risk of exploration.

Below is a complete list of all the CVEs that Microsoft addressed with September 2024’s Patch Tuesday updates.

Have you updated your Windows device?