Microsoft patches 129 flaws as big updates become new normal

This month's Patch Tuesday includes 23 critical flaws, though none are being actively used by hackers

Microsoft has unveiled this month's Patch Tuesday — and it's another big one.

The September edition of the regular security update addresses a whopping 129 flaws, of which 23 have been labelled critical.

"That brings us to seven straight months of 110+ CVEs," notes Dustin Childs, head of communications at Trend Micro's Zero Day Initiative. "It also brings the yearly total close to 1,000. It certainly seems like this volume is the new normal for Microsoft patches."

The vulnerabilities hit a variety of Microsoft products, with 37 in Windows, 16 in SharePoint, ten in Dynamics, and eight in Office. While there's a high number of flaws, none are being used actively by hackers, Microsoft said. The full details are available in Microsoft's release notes.

"While none of the critical vulnerabilities appear to be under active attack (at the time of review), there is a higher count of vulnerabilities Microsoft has chosen to label as critical — at least in comparison to the last few months," noted Gill Langston, head of security at SolarWinds MSP, adding that most of the remaining flaws are marked as important rather than low or moderate.

One of the more alarming set of vulnerabilities was in SharePoint, which could allow remote code execution, while there's also a patch for Windows Defender Application Control. Another severe flaw was found in Exchange Server, which could allow hackers to takeover and execute code via a malicious email sent to an affected Exchange Server.

"That is about the worst-case scenario for Exchange servers," said Childs, adding that a similar Exchange bug that's now patched was quickly taken up by hackers. "We'll likely see this one in the wild soon. This should be your top priority."

The large volume of patches could be a problem for companies supporting remote workers, noted Justin Knapp, product marketing manager at Automox, advising companies take the time to ensure patches are rolled out across their decentralised workforces' devices.

Related Resource

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

A fast guide to remote working from HPDownload now

"As many organisations continue to struggle to support the ongoing distribution of remote workers, Microsoft continues to pile on the updates," he told Threatpost. "Finding an efficient method for rolling out these patches has become even more imperative as companies begin to abandon the idea of a short-term fix and shift operations to embrace remote work as part of a lasting, long-term progression of how organisations operate moving forward."

Indeed, this month's set of patches is a good reminder to limit admin rights, notes Langston. "[Several] of this month’s vulnerabilities are privilege-specific, meaning that users who do not have administrative rights pose less of a risk than a user with full rights to a system," he said.

"As is best practice, it’s a good idea to audit the rights you allow your users to have on workstation systems. While it’s more convenient to simply make them administrators, limiting their rights on workstations can reduce the risk when they inevitably click on that link or visit a malicious webpage."

Featured Resources

Preparing for AI-enabled cyber attacks

MIT technology review insights

Download now

Cloud storage performance analysis

Storage performance and value of the IONOS cloud Compute Engine

Download now

The Forrester Wave: Top security analytics platforms

The 11 providers that matter most and how they stack up

Download now

Harness data to reinvent your organisation

Build a data strategy for the next wave of cloud innovation

Download now

Recommended

Senate report slams agencies for poor cyber security
cyber security

Senate report slams agencies for poor cyber security

3 Aug 2021
Most employees put their workplace at risk by taking cyber security shortcuts
cyber security

Most employees put their workplace at risk by taking cyber security shortcuts

27 Jul 2021
61% of organizations say improving security a top priority for 2021
cyber security

61% of organizations say improving security a top priority for 2021

29 Jun 2021
ProtectedBy.AI’s CodeLock blocks malware at source code level
software as a service (SaaS)

ProtectedBy.AI’s CodeLock blocks malware at source code level

9 Jun 2021

Most Popular

RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
Samsung Galaxy S21 5G review: A rose-tinted experience
Mobile Phones

Samsung Galaxy S21 5G review: A rose-tinted experience

14 Jul 2021
Zyxel USG Flex 200 review: A timely and effective solution
Security

Zyxel USG Flex 200 review: A timely and effective solution

28 Jul 2021