🔃 Security Update Guide: Critical Microsoft Vulnerability CVE-2023-42790 Requires Immediate Patching

Microsoft has issued security guidance for CVE-2023-42790, a critical vulnerability affecting multiple Microsoft products. The vulnerability could allow an attacker to execute arbitrary code with elevated privileges.

Affected Products:

• Windows 10 (Version 1903 and later)
• Windows 11 (All versions)
• Microsoft Office 2019 and Microsoft 365 Apps
• Microsoft Edge (Chromium-based)
• Azure Sphere OS

Severity: CVSS 9.8 (Critical)

The vulnerability exists due to improper handling of memory objects in multiple components. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system.

Microsoft has released security updates to address this vulnerability. Organizations should prioritize deploying these updates across their infrastructure immediately.

Mitigation Steps:

1. Apply the latest security updates for affected Microsoft products
2. Enable automatic updates where possible
3. Implement the principle of least privilege for user accounts
4. Deploy additional security controls such as application whitelisting

Timeline:

• Vulnerability discovered: June 15, 2023
• Security updates released: July 11, 2023
• Next security patch cycle: August 8, 2023

Microsoft has not detected any evidence of this vulnerability being exploited in the wild. However, given the severity and potential impact, immediate action is recommended.

For more information, see the Microsoft Security Response Center and the official security advisory.