Patch Tuesday, September 2021
Microsoft's monthly security release, Tuesday, September 14, 2021. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
7 CVEs · 1 critical · 7 exploited · 4 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
7 CVEs · 1 critical · 7 exploited · 4 with public exploit code
- 9.8CriticalSep 15, 2021Microsoft Open Management Infrastructure (OMI) Auth bypass / access controlCVE-2021-38647Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.Exploited100% likelyExploit codeMetasploit · NucleiDetection
- 8.8HighSep 15, 2021Microsoft MSHTML Path traversal / file handlingCVE-2021-40444Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution.Exploited98% likelyExploit codeMetasploitDetection
- 7.8HighSep 15, 2021Microsoft Windows Privilege escalationCVE-2021-36955Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.Exploited4.1% likelyExploit code
- 7.8HighSep 15, 2021Microsoft Open Management Infrastructure (OMI) Auth bypass / access controlCVE-2021-38648Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.Exploited11% likelyExploit codeMetasploit
- 7.8HighSep 15, 2021Microsoft Open Management Infrastructure (OMI) Privilege escalationCVE-2021-38645Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.Exploited2.7% likely
- 7.8HighSep 15, 2021Microsoft Office Code / command injectionCVE-2021-38646Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.Exploited8% likely
- 7.0HighSep 15, 2021Microsoft Open Management Infrastructure (OMI) Privilege escalationCVE-2021-38649Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.Exploited2.9% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
1 CVE · 1 critical · 1 exploited · 1 with public exploit code
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.