Patch Tuesday, July 2020
Microsoft's monthly security release, Tuesday, July 14, 2020. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
3 CVEs · 2 critical · 3 exploited · 2 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
3 CVEs · 2 critical · 3 exploited · 2 with public exploit code
- 10.0CriticalJul 14, 2020Microsoft Windows Code / command injectionCVE-2020-1350Windows DNS Server is affected. An attacker gains Remote Code Execution. Patch Windows DNS Server with the latest security updates.Exploited97% likelyExploit codeDetection
- 7.8HighJul 14, 2020Microsoft .NET Framework, SharePoint, Visual Studio Code / command injectionCVE-2020-1147Microsoft .NET Framework, SharePoint, and Visual Studio are affected. An attacker gains remote code execution and potentially elevated privileges. Update to the latest version of the affected software or apply the corresponding security patch.Exploited94% likelyExploit codeExploit-DB · MetasploitDetection
- 9.0CriticalJul 14, 2020Microsoft Hyper-V RemoteFX Code / command injectionCVE-2020-1040Microsoft Hyper-V RemoteFX vGPU contains an improper input validation vulnerability due to the host server failing to properly validate input from an authenticated user on a guest operating system. Successful exploitation allows for remote code execution on the host operating system.Exploited7.4% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
1 CVE · 1 critical · 1 exploited · 1 with public exploit code
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.