Patch Tuesday, May 2021
Microsoft's monthly security release, Tuesday, May 11, 2021. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
2 CVEs · 1 critical · 2 exploited · 2 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
2 CVEs · 1 critical · 2 exploited · 2 with public exploit code
- 9.8CriticalMay 11, 2021Microsoft HTTP Protocol Stack Memory corruptionCVE-2021-31166Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.Exploited100% likelyExploit codeMetasploitDetection
- 6.6MediumMay 11, 2021Microsoft Exchange ServerCVE-2021-31207Microsoft Exchange Server An attacker gains unauthorized access to sensitive data and system functionality. Patch Exchange Server with latest updates from Microsoft.Exploited100% likelyExploit codeMetasploitDetection
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.