Microsoft Patch Tuesday 2024: Critical Vulnerabilities Addressed in Latest Security Update

March 2024 brings a fresh focus on cybersecurity as Microsoft rolls out its latest set of patches, addressing 61 vulnerabilities in the Microsoft Patch Tuesday 2024 update.

This regular security update from Microsoft aims to fortify the security of its systems against potential threats and attacks. Notably, this month’s Patch Tuesday does not reveal any zero-day vulnerabilities. However, it includes fixes for several critical issues that could potentially be exploited by cyber attackers if left unaddressed.

Among the vulnerabilities patched are those impacting various Microsoft products, including Windows, Azure, Skype for Consumer, Microsoft Defender, and Microsoft Office.

Microsoft Patch Tuesday 2024 Update: The Most Critical Vulnerabilities

One of the most critical vulnerabilities addressed in this Microsoft Patch Tuesday 2024 update is a remote code execution (RCE) flaw in Windows, which could enable a virtual machine to escape from a Hyper-V guest.

This particular vulnerability, labeled as CVE-2024-21407, presents a high level of complexity for attackers, requiring them to gather specific information about the environment and execute a series of preparatory steps. Once exploited, attackers could gain unauthorized access to the Hyper-V host, posing a significant risk to system integrity.

Another noteworthy fix is for Skype for Consumer, addressing a remote code execution vulnerability (CVE-2024-21411) that could be triggered through malicious links or images sent via Instant Message. This flaw, discovered by Hector Peralta and Nicole Armua in collaboration with Trend Micro Zero Day Initiative, highlights the importance of staying up to date against social engineering tactics employed by cybercriminals.

Furthermore, Microsoft has patched vulnerabilities affecting its Azure Kubernetes Service (CVE-2024-21400), Microsoft Defender (CVE-2024-20671), and Microsoft Office (CVE-2024-26199), among others. These fixes aim to mitigate various risks, including elevation of privilege, security feature bypass, and confidential container compromise.

APT Groups Exploiting Microsoft Vulnerabilities

In a conversation with TCE, Satnam Narang, Senior Staff Research Engineer, Tenable, shared his take on the Microsoft Patch Tuesday 2024 update, noting, “Of the 60 CVEs patched…only six are considered more likely to be exploited.” He highlighted elevation of privilege vulnerabilities such as CVE-2024-26182 and CVE-2024-26170, often exploited by advanced persistent threat (APT) groups for espionage.

Narang explained that while some vulnerabilities require social engineering, like CVE-2024-21426 in Microsoft SharePoint Server, they still pose a threat if attackers can manipulate users. Notably, CVE-2024-21390, an elevation of privilege flaw in Microsoft Authenticator, allows attackers with device access to bypass multi-factor authentication, emphasizing the importance of device security.

Narang also observed a decrease in CVEs patched in 2024 compared to previous years, suggesting a shift in cybersecurity trends, stating, “The first quarter of Patch Tuesday in 2024 has been quieter compared to the last four years.

Security Updates for Other Microsoft Products

Additionally, Microsoft has addressed vulnerabilities in Windows 11, SharePoint, and the Windows Print Spooler service, targeting issues such as compressed folder tampering and elevation to SYSTEM privileges. These fixes are crucial for maintaining the overall security posture of Windows-based systems and preventing potential exploitation by malicious actors.

While no prior public disclosure or exploitation in the wild has been reported for the vulnerabilities patched in this update, it’s essential for users and administrators to promptly apply the patches to mitigate any potential risks. 

Windows updates ensure device security and productivity, catering to both IT administrators and general users. These monthly updates, released on “Patch Tuesday,” consolidate security and non-security fixes to maintain device integrity. 

Through channels like Windows Update and Microsoft Intune, users receive mandatory security updates. Additionally, optional non-security preview releases, available a week before security updates, offer advanced features. Out-of-band releases address critical issues promptly. 

With Windows 11, continuous innovation arrives through phased rollouts, allowing users to control feature releases. Microsoft optimizes update processes for reliability, ensuring a seamless user experience while prioritizing device security and performance.

Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.