As this specific exploit would not require any form of authentication, it’s even more appealing for attackers, and any organization using HTTP.sys protocol stack should prioritize this patch.”īreen also called attention to CVE-2021-26419 - a vulnerability in Internet Explorer 11 - to make the case for why IE needs to stand for “Internet Exploder.” To trigger this vulnerability, a user would have to visit a site that is controlled by the attacker, although Microsoft also recognizes that it could be triggered by embedding ActiveX controls in Office Documents.

“Wormable exploits should always be a high priority, especially if they are for services that are designed to be public facing. “For ransomware operators, this kind of vulnerability is a prime target for exploitation,” Breen said. Kevin Breen from Immersive Labs said the fact that this one is just 0.2 points away from a perfect 10 CVSS score should be enough to identify just how important it is to patch. Definitely put this on the top of your test-and-deploy list.” “Before you pass this aside, Windows 10 can also be configured as a web server, so it is impacted as well.

“That makes this bug wormable, with even Microsoft calling that out in their write-up,” said Dustin Childs, with Trend Micro’s ZDI program. With this weakness, an attacker could compromise a host simply by sending it a specially-crafted packet of data. By all accounts, the most pressing priority this month is CVE-2021-31166, a Windows 10 and Windows Server flaw which allows an unauthenticated attacker to remotely execute malicious code at the operating system level. While May brings about half the normal volume of updates from Microsoft, there are some notable weaknesses that deserve prompt attention, particularly from enterprises. On deck this month are patches to quash a wormable flaw, a creepy wireless bug, and yet another reason to call for the death of Microsoft’s Internet Explorer (IE) web browser. Four of these weaknesses can be exploited by malware and malcontents to seize complete, remote control over vulnerable systems without any help from users. Microsoft today released fixes to plug at least 55 security holes in its Windows operating systems and other software.

Kb5003173 0x800f0922