Patch Tuesday, August 2021
Microsoft's monthly security release, Tuesday, August 10, 2021. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
4 CVEs · 0 critical · 4 exploited · 2 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
4 CVEs · 0 critical · 4 exploited · 2 with public exploit code
- 7.8HighAug 12, 2021Microsoft Windows Memory corruptionCVE-2021-34486Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation.Exploited9.3% likelyExploit code
- 7.5HighAug 12, 2021Microsoft WindowsCVE-2021-36942Windows Local Security Authority (LSA) is affected. An attacker gains ability to impersonate a legitimate user, potentially gaining elevated privileges. Patch Windows systems with the latest security updates to prevent exploitation.Exploited66% likelyExploit codeMetasploit
- 7.8HighAug 12, 2021Microsoft Windows Privilege escalationCVE-2021-34484Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.Exploited22% likelyDetection
- 7.8HighAug 12, 2021Microsoft Windows Privilege escalationCVE-2021-36948Windows Update Medic Service is affected. An attacker gains elevated privileges, potentially allowing for arbitrary code execution. Patch Windows Update Medic Service to the latest version.Exploited23% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.