Microsoft patches 129 flaws as big updates become new normal

Microsoft has unveiled this month's Patch Tuesday — and it's another big one.

The September edition of the regular security update addresses a whopping 129 flaws, of which 23 have been labelled critical.

"That brings us to seven straight months of 110+ CVEs," notes Dustin Childs, head of communications at Trend Micro's Zero Day Initiative. "It also brings the yearly total close to 1,000. It certainly seems like this volume is the new normal for Microsoft patches."

The vulnerabilities hit a variety of Microsoft products, with 37 in Windows, 16 in SharePoint, ten in Dynamics, and eight in Office. While there's a high number of flaws, none are being used actively by hackers, Microsoft said. The full details are available in Microsoft's release notes.

"While none of the critical vulnerabilities appear to be under active attack (at the time of review), there is a higher count of vulnerabilities Microsoft has chosen to label as critical — at least in comparison to the last few months," noted Gill Langston, head of security at SolarWinds MSP, adding that most of the remaining flaws are marked as important rather than low or moderate.

One of the more alarming set of vulnerabilities was in SharePoint, which could allow remote code execution, while there's also a patch for Windows Defender Application Control. Another severe flaw was found in Exchange Server, which could allow hackers to takeover and execute code via a malicious email sent to an affected Exchange Server.

"That is about the worst-case scenario for Exchange servers," said Childs, adding that a similar Exchange bug that's now patched was quickly taken up by hackers. "We'll likely see this one in the wild soon. This should be your top priority."

The large volume of patches could be a problem for companies supporting remote workers, noted Justin Knapp, product marketing manager at Automox, advising companies take the time to ensure patches are rolled out across their decentralised workforces' devices.

"As many organisations continue to struggle to support the ongoing distribution of remote workers, Microsoft continues to pile on the updates," he told Threatpost. "Finding an efficient method for rolling out these patches has become even more imperative as companies begin to abandon the idea of a short-term fix and shift operations to embrace remote work as part of a lasting, long-term progression of how organisations operate moving forward."

Indeed, this month's set of patches is a good reminder to limit admin rights, notes Langston. "[Several] of this month’s vulnerabilities are privilege-specific, meaning that users who do not have administrative rights pose less of a risk than a user with full rights to a system," he said.

"As is best practice, it’s a good idea to audit the rights you allow your users to have on workstation systems. While it’s more convenient to simply make them administrators, limiting their rights on workstations can reduce the risk when they inevitably click on that link or visit a malicious webpage."