Microsoft patches 129 flaws as big updates become new normal

This month's Patch Tuesday includes 23 critical flaws, though none are being actively used by hackers

Microsoft has unveiled this month's Patch Tuesday — and it's another big one.

The September edition of the regular security update addresses a whopping 129 flaws, of which 23 have been labelled critical.

"That brings us to seven straight months of 110+ CVEs," notes Dustin Childs, head of communications at Trend Micro's Zero Day Initiative. "It also brings the yearly total close to 1,000. It certainly seems like this volume is the new normal for Microsoft patches."

The vulnerabilities hit a variety of Microsoft products, with 37 in Windows, 16 in SharePoint, ten in Dynamics, and eight in Office. While there's a high number of flaws, none are being used actively by hackers, Microsoft said. The full details are available in Microsoft's release notes.

"While none of the critical vulnerabilities appear to be under active attack (at the time of review), there is a higher count of vulnerabilities Microsoft has chosen to label as critical — at least in comparison to the last few months," noted Gill Langston, head of security at SolarWinds MSP, adding that most of the remaining flaws are marked as important rather than low or moderate.

One of the more alarming set of vulnerabilities was in SharePoint, which could allow remote code execution, while there's also a patch for Windows Defender Application Control. Another severe flaw was found in Exchange Server, which could allow hackers to takeover and execute code via a malicious email sent to an affected Exchange Server.

"That is about the worst-case scenario for Exchange servers," said Childs, adding that a similar Exchange bug that's now patched was quickly taken up by hackers. "We'll likely see this one in the wild soon. This should be your top priority."

The large volume of patches could be a problem for companies supporting remote workers, noted Justin Knapp, product marketing manager at Automox, advising companies take the time to ensure patches are rolled out across their decentralised workforces' devices.

Related Resource

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

A fast guide to remote working from HPDownload now

"As many organisations continue to struggle to support the ongoing distribution of remote workers, Microsoft continues to pile on the updates," he told Threatpost. "Finding an efficient method for rolling out these patches has become even more imperative as companies begin to abandon the idea of a short-term fix and shift operations to embrace remote work as part of a lasting, long-term progression of how organisations operate moving forward."

Indeed, this month's set of patches is a good reminder to limit admin rights, notes Langston. "[Several] of this month’s vulnerabilities are privilege-specific, meaning that users who do not have administrative rights pose less of a risk than a user with full rights to a system," he said.

"As is best practice, it’s a good idea to audit the rights you allow your users to have on workstation systems. While it’s more convenient to simply make them administrators, limiting their rights on workstations can reduce the risk when they inevitably click on that link or visit a malicious webpage."

Featured Resources

Unlocking collaboration: Making software work better together

How to improve collaboration and agility with the right tech

Download now

Four steps to field service excellence

How to thrive in the experience economy

Download now

Six things a developer should know about Postgres

Why enterprises are choosing PostgreSQL

Download now

The path to CX excellence for B2B services

The four stages to thrive in the experience economy

Download now

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
University of Hertfordshire's entire IT system offline after cyber attack
cyber attacks

University of Hertfordshire's entire IT system offline after cyber attack

15 Apr 2021
NSA uncovers new "critical" flaws in Microsoft Exchange Server
servers

NSA uncovers new "critical" flaws in Microsoft Exchange Server

14 Apr 2021