Microsoft’s September Patch Tuesday covers 79 Microsoft CVEs and includes four actively exploited zero-days.

The Cybersecurity and infrastructure Security Agency (CISA) has added four of these CVEs to its known exploited vulnerabilities catalog, based on evidence of active exploitation. The actively exploited CVEs from Microsoft’s September Patch Tuesday are:

CVE-2024-38226 (CVSS score 7.3 out of 10): a Microsoft Publisher security feature bypass vulnerability. An attacker who successfully exploited this vulnerability could bypass Office macro policies used to block untrusted or malicious files. The attacker needs to be an authenticated user to exploit the vulnerability by convincing a victim, through social engineering, to download and open a specially crafted file from a website which could lead to a local attack on the victim’s computer.

Microsoft Publisher is a standalone application included in some versions of Microsoft Office. This flaw lets attackers bypass Microsoft’s Mark of the Web (MOTW)—the technology that prevents users running macros in documents downloaded from the internet.

CVE-2024-43491 (CVSS score 9.8 out of 10): a Microsoft Windows Update remote code execution (RCE) vulnerability. This vulnerability in Servicing Stack allows an attacker to exploit previously mitigated vulnerabilities on Windows 10 Enterprise 2015 LTSB and Windows 10 IoT Enterprise 2015 LTSB systems that have installed the Windows security update released on March 12, 2024 or other updates released until August 2024. All later versions of Windows 10 are not impacted by this vulnerability. This servicing stack vulnerability is addressed by installing the September 2024 Servicing stack update (SSU KB043936) AND the September 2024 Windows security update (KB5043083), in that order. Customers whose systems are configured to receive automatic updates do not need to take any further action.

Microsoft notes: Windows 10, version 1507 reached the end of support (EOS) on May 9, 2017 for devices running the Pro, Home, Enterprise, Education, and Enterprise IoT editions. Only Windows 10 Enterprise 2015 LTSB and Windows 10 IoT Enterprise 2015 LTSB editions are still under support.

CVE-2024-38014 (CVSS score 7.8 out of 10): a Microsoft Windows Installer privilege escalation vulnerability. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Privilege escalation vulnerabilities are often used in combination with other vulnerabilities to get the necessary permissions to further compromise an attacked system.

CVE-2024-38217 (CVSS score 5.4 out of 10): another Microsoft Windows Mark of the Web (MOTW) security feature bypass vulnerability. An attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses. To exploit this vulnerability, an attacker could host a file on an attacker-controlled server, then convince a targeted user to download and open the file. This vulnerability has been publicly disclosed and exploit code has been made available.

Other vendors

Other vendors have synchronized their periodic updates with Microsoft. Here are a few major ones that you may find in your environment.

Adobe has released security updates for Adobe Acrobat and Reader.

Android saw several important patches in its September Security bulletin.

Ivanti released a security advisory which tackles several important vulnerabilities.

SonicWall issued a patch for a vulnerability actively exploited by ransomware groups.