Hackers Exploiting Two New Flaws in Windows 10. Microsoft Rolls out Monthly Patch to Address Them (and Other Critical Bugs)

As part of its monthly security update for Windows users, Microsoft this week has rolled out patches for 55 vulnerabilities, some of which are critical and even exploited in the wild by attackers. It’s a good time to patch your home PC!

Of the 55 bugs plugged this Patch Tuesday, six are critical and two are being leveraged for targeted attacks, the advisories say.

For example, this remote code execution (RCE) flaw affecting Microsoft Exchange Server (CVE-2021-42321) is caused by improper validation of cmdlet arguments. To exploit it, attackers need to be authenticated in the Exchange Server.

This security feature bypass in Microsoft Excel (CVE-2021-42292) may require user interaction but it’s equally dangerous, especially with Microsoft receiving reports that this flaw is also being exploited. The vulnerability affects Excel customers not just in Windows environments, but also the macOS version of Microsoft’s versatile spreadsheet app.

With a severity score of 9.0, another vulnerability affects Microsoft Virtual Machine Bus (VMBus). Tracked as CVE-2021-26443, the vulnerability can be exploited by an authenticated attacker to send a specially crafted communication on the VMBus channel from the guest VM to the Host. If exploited successfully, the vulnerability lets attackers execute their code of choice on the target machine.

And this critical RCE flaw in Remote Desktop Client (CVE-2021-38666) could theoretically let an attacker controlling a Remote Desktop Server conduct remote code execution on the RDP client machine when a victim connects to the attacking server with the vulnerable Remote Desktop Client.

Microsoft has seen no sign of active exploitation of this particular flaw. However, it is just as likely to be exploited - now even more so that the word is out.

It’s highly recommended that you patch your current Windows instance, as many of these flaws are critical and at least two are known to be exploited in the wild, meaning millions of PCs are ripe for the picking by bad actors.

Launch the Start menu, click Settings, then choose Update & Security and then Check for Updates. When Windows finds the new version, it will start downloading the update automatically. When you’re ready, give your PC a green light to install this week’s patch bundle. You may also want to consider turning on Automatic Updates to stay on top of new releases without having to check the news all the time.

Be sure to save your work before installing the patch. As a general rule, it’s recommended that you keep regular backups of your most important files in case something goes awry during the update.