Tag: zerodays

Critical Security Flaws in Microsoft's Latest Patch Tuesday Update Microsoft's latest Patch Tuesday update includes two zero-day vulnerabilities that are causing concern for security teams. The first is a denial of service (DoS) issue in .NET, tracked as CVE-2026-26127, with a CVSS score of 7.5. The second is an elevation of privilege (EoP) issue in SQL Server, tracked as CVE-2026-21262, with a CVSS score of 8.8. While these vulnerabilities have not yet been exploited, Microsoft warns that it is only a matter of time before attackers take advantage of them. The DoS vulnerability in .NET allows unauthenticated attackers to disrupt network services through an out-of-bounds read condition. Although Microsoft believes the likelihood of exploitation is low, Rapid7's Adam Barnett warns that attackers could use the vulnerability to cover up more damaging attacks or cause service downtime, leading to SLA breaches or revenue impacts. The EoP vulnerability in SQL Server, on the other hand, requires an attacker to already have authorized access to the network. However, Barnett highlights the potential risks if an attacker gains admin rights, such as exploiting the xp_cmdshell function to execute operating system commands with full privileges. Aside from these critical vulnerabilities, the Patch Tuesday update also addresses eight other critically rated vulnerabilities, including three remote code execution (RCE) flaws in Microsoft ACI Confidential Containers and Microsoft Office. Bicer from Action1 emphasizes the high-risk nature of RCE vulnerabilities in productivity software like Office, which could be exploited to gain control of systems, deploy ransomware, or steal sensitive data. To mitigate the risks posed by these vulnerabilities, Bicer recommends applying security updates promptly, disabling the Preview Pane in file explorers, and restricting the opening of Office files from untrusted sources. Implementing email filtering, attachment scanning, and endpoint protection monitoring can also help reduce the risk of malicious document delivery.

Tag: zerodays

Microsoft patches zero-days in .NET and SQL Server

August Patch Tuesday proves busy with six zero-days to fix

Quick Links

Resources

Support