notification settings

Attackers are exploiting a significant number of vulnerabilities disclosed by Microsoft in its August security update, with six out of 90 vulnerabilities being a primary concern for system administrators. Four of these vulnerabilities were known prior to the announcement and are categorized as zero-days, including CVE-2024-38202, an unpatched elevation of privilege (EoP) vulnerability in the Windows Update Stack. This flaw allows an attacker with basic user privileges to potentially reintroduce mitigated vulnerabilities or bypass features of Virtualization Based Security (VBS). Seven vulnerabilities from the update are rated as critical, while the remaining 79 CVEs are deemed "Important" or of medium severity. Two of the actively exploited vulnerabilities facilitate remote code execution (RCE): CVE-2024-38189 affects Microsoft Project, allowing arbitrary code execution if a user opens a malicious file, and CVE-2024-38178 involves a memory corruption issue in the Windows Scripting Engine, requiring user interaction. Additionally, three other zero-days under active exploitation (CVE-2024-38106, CVE-2024-38107, and CVE-2024-38193) enable privilege elevation to system admin status, with CVE-2024-38106 being particularly concerning due to its presence in the Windows Kernel. The final zero-day, CVE-2024-38213, allows attackers to bypass Windows Mark of the Web security protections, facilitating the infiltration of malicious files and web content into enterprise environments.