Microsoft reports 81 zero-day exploits—Patch your desktops now to escape cyberattacks

Patching vulnerabilities is always a priority, but patching is even more important when those vulnerabilities can lead to random zero-day attacks. If you have any Windows computers in your network, we can think of at least 81 reasons you should completely patch your systems this September. Following Microsoft’s release of security patches for 81 separate zero-day exploits this past Patch Tuesday, we’ve collaborated with our in-house vulnerability expert Mike to analyze these new patches and come up with a strategy to keep your organization protected.

According to Mike, there are huge number of security updates that need to be patched for Microsoft products. Of the 81 zero-day exploits Microsoft’s released patches for, Mike states that there are 27 critical zero-day vulnerabilities and 54 important ones that need to be patched right away.

List of the identified zero-day exploits

According to Mike’s analysis, quite a few Microsoft products are affected by these zero-day vulnerabilities, including: 

1. Internet Explorer
2. Microsoft Windows
3. Microsoft Edge
4. Microsoft Exchange Server
5. .NET Framework
6. Skype for Business and Lync
7. Adobe Flash Player
8. Microsoft Office, Microsoft Services, and Web Apps

Cybersecurity researchers from FireEye discovered the zero-day vulnerability in Windows .NET Framework RCE and reported the issue to Microsoft. According to Mike’s analysis, this zero-day vulnerability allows attackers to breach Windows systems and gain complete control over infected machines. Attackers can infect computers simply by luring end users into opening a random document over email.

Apart from the critical .NET Framework RCE vulnerability reported above, Mike has analyzed three other zero-day exploits, including: 

1. Device Guard security feature bypass vulnerability
2. Microsoft Edge security feature bypass vulnerability
3. Broadcom BCM43xx remote code execution vulnerability

The zero-day exploit in Device Guard allows attackers to inject malicious code into Windows PowerShell sessions by breaching the device’s security policies. The other two zero-day exploits can trick users into visiting some malicious website, giving attackers administrator privileges on infected computers.

Excluding the above zero-day exploits, Mike also reminds users to update their Microsoft applications like Windows Hyper-V, SharePoint, and Microsoft Office with the latest security patches to avoid any remote code execution capabilities.

How can you patch these zero-day exploits?

According to Mike, there are two simple ways to resolve these vulnerabilities: 

• If you’re updating one computer, you can simply navigate to Updates & Security—> Windows Update—-> Check for updates on your PC, or you can install these updates manually.
• If you’re managing more than a few computers, you can download our patch management solution Desktop Central and start updating all your Windows computers right away.

And as a friendly reminder from Mike:

“Update your Microsoft security patches now, and keep your systems and networks free from ransomware, malware, and other evolving threats.”