Fixes have been issued by Microsoft for 139 security vulnerabilities impacting its products, including four zero-day flaws, two of which have been actively exploited, as part of this month's Patch Tuesday, reports SC Media.
Included in the issues under ongoing abuse is a privilege escalation bug in Windows Hyper-V hypervisor, tracked as CVE-2024-38080, which could be leveraged to infiltrate systems, as well as the mysterious flaw, tracked as CVE-2024-38112, which has been noted by Microsoft to have a "spoofing" impact.
However, none of the zero-days were reported by Microsoft to be possibly used to facilitate remote device takeovers. Microsoft has also addressed five critical remote code execution flaws, three of which were in the Remote Desktop Licensing Service component of Windows. Organizations have been urged by Trend Micro Zero Day Initiative's Dustin Childs to deactivate the Licensing Service if not needed to avert potential compromise.
"I would also ensure these servers are not addressable to the Internet. If a bunch of these servers are Internet-connected, I would expect exploitation soon," Childs added.
