Adrian Johnson
TLDR:
– CISA warns of four Microsoft vulnerabilities that are being actively exploited by hackers.
– The vulnerabilities affect widely used Microsoft tools like Windows Update and Windows Publisher.
Article Summary:
Federal civilian agencies have been warned by the Cybersecurity and Infrastructure Security Agency (CISA) to address four critical vulnerabilities in Microsoft products that are currently being targeted by hackers. These vulnerabilities, identified as CVE-2024-38226, CVE-2024-43491, CVE-2024-38014, and CVE-2024-38217, were part of Microsoft’s monthly security update and affect tools like Windows Update, Windows Publisher, and Windows Installer.
Experts have highlighted CVE-2024-43491 as the most concerning, with a severity score of 9.8 out of 10. However, it only impacts a specific version of Windows 10 released in July 2015. CVE-2024-38226 and CVE-2024-38014 are also significant as they allow attackers to bypass security features and escalate access privileges within a system.
The fourth vulnerability, CVE-2024-38217, affects Windows Mark of the Web and allows attackers to manipulate security warnings, making it a prime target for cybercriminals seeking to infiltrate corporate networks. Exploit code for this vulnerability is readily available on GitHub, further increasing the risk.
Overall, organizations, especially those in healthcare, finance, and government sectors, are strongly advised to prioritize these updates to avoid potential data theft and operational downtime. Other companies like Ivanti, Cisco, Adobe, and Fortinet have also released security updates addressing severe bugs, highlighting the ongoing threat of cyberattacks in the technology sector.
