IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Exchange Server zero-day among latest Microsoft Patch Tuesday fixes

The firm has patched three zero-day vulnerabilities across its products that haven’t yet been exploited

Microsoft has patched 55 vulnerabilities across a swathe of its products as part of its latest round of Patch Tuesday fixes, including three zero-day vulnerabilities that haven’t yet been publicly exploited.

The most alarming of the flaws, tracked as CVE-2021-31207, is present in the Microsoft Exchange Server platform, which was at the heart of a devastating supply chain attack earlier in the year. 

This vulnerability is a security feature bypass flaw and was discovered as part of last month’s Pwn2Own contest. Although it hasn’t been exploited by cyber criminals, details of the exploitation demonstrated in the contest will be published soon.

The Exchange Server flaw has been patched alongside CVE-2021-31204, an elevation of privilege vulnerability in .NET and Visual Studio, as well as CVE-2021-31200, a remote code execution flaw in the Common Utilities component.  

Four of the flaws patched as part of the 55 are classed as ‘critical’, and none of them are the three zero-days highlighted. These include remote code execution flaws in HTTP.sys, Windows OLE Automation and Hyper-V, as well as a scripting engine memory corruption bug in Internet Explorer.

The 55 CVEs patched in May represents the smallest wave of Patch Tuesday fixes so far in 2021, after more than 100 were addressed this time last month. This wave included patches for five zero-days vulnerabilities and four critical Microsoft Exchange Server flaws discovered by the NSA. 

Related Resource

The definitive guide to IT security

Protecting your MSP and your customers

The definitive guide to IT security for MSPs - whitepaper from LiongardDownload now

The most serious of the five zero-days included CVE-2021-28310, an escalation of privilege flaw in the Desktop Window Manager component of Windows 10 that was likely being used in a chain alongside other vulnerabilities to seize control of machines.

Although CVE-2021-31207, patched this month, is deemed as less likely to be exploited, cyber criminals will be working hard to reverse engineer an exploit from the fix released this week.

The fact that details around a successful exploitation, as demonstrated in the Pwn2Own contest, could be published soon too, should urge businesses to patch their vulnerable systems as soon as possible.

Featured Resources

Join the 90% of enterprises accelerating to the cloud

Business transformation through digital modernisation

Free Download

Delivering on demand: Momentum builds toward flexible IT

A modern digital workplace strategy

Free download

Modernise the workforce experience

Actionable insights and an optimised experience for both IT and end users

Free Download

The digital workplace roadmap

A leader's guide to strategy and success

Free Download

Recommended

Microsoft identifies sophisticated Hive ransomware variant written in Rust
Security

Microsoft identifies sophisticated Hive ransomware variant written in Rust

6 Jul 2022
Microsoft reportedly blocks Russian Windows 10 and Windows 11 downloads
Microsoft Windows

Microsoft reportedly blocks Russian Windows 10 and Windows 11 downloads

20 Jun 2022
IT Pro News in Review: UK tech raises $16bn, Microsoft acquires Miburo, largest DDoS attack mitigated
Business strategy

IT Pro News in Review: UK tech raises $16bn, Microsoft acquires Miburo, largest DDoS attack mitigated

17 Jun 2022
Proofpoint details 'dangerous' ransomware flaw in SharePoint and OneDrive
ransomware

Proofpoint details 'dangerous' ransomware flaw in SharePoint and OneDrive

17 Jun 2022

Most Popular

Universities are fighting a cyber security war on multiple fronts
cyber security

Universities are fighting a cyber security war on multiple fronts

4 Jul 2022
Hackers claim to steal personal data of over a billion people in China
data breaches

Hackers claim to steal personal data of over a billion people in China

4 Jul 2022
Raspberry Pi launches next-gen Pico W microcontroller with networking support
Hardware

Raspberry Pi launches next-gen Pico W microcontroller with networking support

1 Jul 2022