Critical Microsoft Security Updates Address Multiple Zero-Day Vulnerabilities

Microsoft has released emergency security updates addressing multiple critical vulnerabilities, including two zero-day exploits under active exploitation. Organizations must apply these patches immediately to prevent potential breaches.

Affected Products

The updates impact multiple Microsoft products:

• Windows 10 and Windows 11
• Windows Server 2019, 2022, and 2016
• Microsoft Edge
• Azure Sphere
• Visual Studio

Critical Vulnerabilities

CVE-2023-36802 (CVSS 9.8)

A privilege escalation vulnerability in Windows Common Log File System Driver allows attackers to gain SYSTEM privileges. Exploitation requires local access but leads to complete system compromise.

CVE-2023-36884 (CVSS 9.8)

A remote code execution vulnerability in Microsoft Outlook allows attackers to execute arbitrary code when a specially crafted email is viewed. This zero-day is being actively exploited in targeted attacks.

CVE-2023-36801 (CVSS 8.1)

An information disclosure vulnerability in Windows Graphics Component could allow an attacker to read sensitive kernel memory.

Mitigation Steps

1. Apply updates immediately - All organizations should prioritize installation of the latest security updates
2. Restart systems - Several vulnerabilities require system restarts for complete protection
3. Verify patch installation - Confirm updates were successfully applied using Microsoft Update Catalog
4. Review logs - Monitor for unusual activity, especially regarding Outlook and file system access

Timeline

• Release Date: July 11, 2023
• Next Security Tuesday: August 8, 2023
• Exploitation Status: CVE-2023-36884 and CVE-2023-36802 are being exploited in the wild

MSRC Response

The Microsoft Security Response Center (MSRC) has rated these updates as critical and urges immediate action. According to the MSRC Blog, the team has confirmed limited targeted exploitation of the Outlook vulnerability before the patch was developed.

Organizations should refer to the Microsoft Security Guide for detailed deployment instructions and additional mitigations for systems that cannot be patched immediately.

Additional Resources

• Microsoft Security Update Guide
• MSRC Security Advisories
• CVE Details

Failure to apply these updates may result in complete system compromise and data breaches. Microsoft has not indicated when these vulnerabilities will be addressed in the next regular security update cycle.