Microsoft patches actively exploited Internet Explorer flaw

The latest Patch Tuesday sees the Windows developer patch a fifth actively exploited bug disclosed within a week

The Internet Explorer icon as seen on a smartphone in behind a screen with lines of code

Microsoft has fixed dozens of security flaws across its suite of products, including a critical Internet Explorer bug that’s been previously exploited by state-backed North Korean hackers to attack security researchers.

The flaw, tracked as CVE-2021-26411, is a memory corruption vulnerability that’s allowed hackers to run malware on victims’ machines by luring them into accessing a malicious website.

This is the fifth actively exploited Microsoft vulnerability to be patched in recent weeks, after four Microsoft Exchange Server flaws were disclosed last week. 

These five fixes were included in the latest Patch Tuesday wave of updates among 89 patches across Microsoft products, including fixes for 14 critically-rated vulnerabilities.

The latest actively-exploited remote code exploitation flaw affects Internet Explorer versions 9 and 11, as well as the HTML-based Microsoft Edge, which itself reached end-of-life today. Internet Explorer will stop being supported with updates from 17 August this year.

The Internet Explorer vulnerability was previously reported as a zero-day by the South Korean security firm Enki in February, which itself was targeted by hackers exploiting the bug.  

To trigger the exploit, an attacker would first have to craft a website, or take advantage of a compromised website and convince a user to view it. This would usually be done by undergoing a phishing exercise, either by sending an email or text message or prompting users to download a malicious email attachment.

Related Resource

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

cost of a data breach report 2020 - whitepaper from IBMDownload now

The discovery of a sixth actively-exploited flaw in recent weeks is sure to raise alarms considering the potentially devastating effects that the recent Microsoft Exchange Server exploitation has rendered.

The White House weighed in over the weekend, advising businesses to patch their systems immediately due to the risk of intrusion, with security researchers warning there could be hundreds of thousands of prospective victims across the world. One organisation that’s among the first confirmed victims of the attacks is the European Banking Authority

Featured Resources

2021 Thales access management index: Global edition

The challenges of trusted access in a cloud-first world

Free download

Transforming higher education for the digital era

The future is yours

Free download

Building a cloud-native, hybrid-multi cloud infrastructure

Get ready for hybrid-multi cloud databases, AI, and machine learning workloads

Free download

The next biggest shopping destination is the cloud

Know why retail businesses must move to the cloud

Free Download

Recommended

Kaspersky exposes MysterySnail zero-day exploit in Windows
zero-day exploit

Kaspersky exposes MysterySnail zero-day exploit in Windows

13 Oct 2021
Nigerian cyber criminals target Texas unemployment system
cyber security

Nigerian cyber criminals target Texas unemployment system

27 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Veritas Backup Exec 21.3 review: Covers every angle
backup software

Veritas Backup Exec 21.3 review: Covers every angle

14 Oct 2021
HPE wins networking contract with Birmingham 2022 Commonwealth Games
Network & Internet

HPE wins networking contract with Birmingham 2022 Commonwealth Games

15 Oct 2021