Microsoft patches 129 flaws as big updates become new normal

This month's Patch Tuesday includes 23 critical flaws, though none are being actively used by hackers

Microsoft has unveiled this month's Patch Tuesday — and it's another big one.

The September edition of the regular security update addresses a whopping 129 flaws, of which 23 have been labelled critical.

"That brings us to seven straight months of 110+ CVEs," notes Dustin Childs, head of communications at Trend Micro's Zero Day Initiative. "It also brings the yearly total close to 1,000. It certainly seems like this volume is the new normal for Microsoft patches."

The vulnerabilities hit a variety of Microsoft products, with 37 in Windows, 16 in SharePoint, ten in Dynamics, and eight in Office. While there's a high number of flaws, none are being used actively by hackers, Microsoft said. The full details are available in Microsoft's release notes.

"While none of the critical vulnerabilities appear to be under active attack (at the time of review), there is a higher count of vulnerabilities Microsoft has chosen to label as critical — at least in comparison to the last few months," noted Gill Langston, head of security at SolarWinds MSP, adding that most of the remaining flaws are marked as important rather than low or moderate.

One of the more alarming set of vulnerabilities was in SharePoint, which could allow remote code execution, while there's also a patch for Windows Defender Application Control. Another severe flaw was found in Exchange Server, which could allow hackers to takeover and execute code via a malicious email sent to an affected Exchange Server.

"That is about the worst-case scenario for Exchange servers," said Childs, adding that a similar Exchange bug that's now patched was quickly taken up by hackers. "We'll likely see this one in the wild soon. This should be your top priority."

The large volume of patches could be a problem for companies supporting remote workers, noted Justin Knapp, product marketing manager at Automox, advising companies take the time to ensure patches are rolled out across their decentralised workforces' devices.

Related Resource

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

"As many organisations continue to struggle to support the ongoing distribution of remote workers, Microsoft continues to pile on the updates," he told Threatpost. "Finding an efficient method for rolling out these patches has become even more imperative as companies begin to abandon the idea of a short-term fix and shift operations to embrace remote work as part of a lasting, long-term progression of how organisations operate moving forward."

Indeed, this month's set of patches is a good reminder to limit admin rights, notes Langston. "[Several] of this month’s vulnerabilities are privilege-specific, meaning that users who do not have administrative rights pose less of a risk than a user with full rights to a system," he said.

"As is best practice, it’s a good idea to audit the rights you allow your users to have on workstation systems. While it’s more convenient to simply make them administrators, limiting their rights on workstations can reduce the risk when they inevitably click on that link or visit a malicious webpage."

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Leading the data race

The trends driving the future of data science

Download now

How to create 1:1 customer experiences at scale

Meet the technology capable of delivering the personalisation your customers crave

Download now

How to achieve daily SAP releases

Accelerate the pace of SAP change to support your digital strategy

Download now

Recommended

Meet Azure Arc, a platform to simplify deployment management
Microsoft Azure

Meet Azure Arc, a platform to simplify deployment management

4 Nov 2019

Most Popular

Microsoft hints at stand-alone successor to Office 2019 suite
Microsoft Office

Microsoft hints at stand-alone successor to Office 2019 suite

24 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020