Patch Tuesday, July 2021
Microsoft's monthly security release, Tuesday, July 13, 2021. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
6 CVEs · 2 critical · 6 exploited · 4 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
6 CVEs · 2 critical · 6 exploited · 4 with public exploit code
- 9.1CriticalJul 14, 2021Microsoft Exchange Server SSRFCVE-2021-34473Microsoft Exchange Server is affected. An attacker gains remote code execution and potentially allows for data theft and system compromise. Patch Microsoft Exchange Server with the latest security updates to mitigate this vulnerability.Exploited100% likelyExploit codeMetasploit · NucleiDetection
- 9.0CriticalJul 14, 2021Microsoft Exchange Server Auth bypass / access controlCVE-2021-34523Microsoft Exchange Server Unauthorized access to sensitive data Patch Exchange Server to the latest version.Exploited100% likelyExploit codeMetasploit
- 7.3HighJul 14, 2021Microsoft Exchange Server Auth bypass / access controlCVE-2021-33766Microsoft Exchange Server, an attacker gains sensitive information, patch with latest security updates.Exploited98% likelyExploit codeNucleiDetection
- 7.2HighJul 14, 2021Microsoft Exchange Server Information disclosureCVE-2021-31196Microsoft Exchange Server is affected. An attacker gains sensitive information about the server and its configuration. Update to the latest version of Microsoft Exchange Server to patch the vulnerability.Exploited54% likelyExploit code
- 7.8HighJul 14, 2021Microsoft Windows Memory corruptionCVE-2021-31979Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.Exploited4.5% likelyDetection
- 7.8HighJul 14, 2021Microsoft Windows Memory corruptionCVE-2021-33771Windows Operating System, Unprivileged code execution with elevated privileges, Patch Windows to the latest version or apply the provided fix.Exploited10% likelyDetection
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.