Multiple key vulnerabilities identified in Microsoft products

Australian Cyber Security Centre

Background /What has happened?

Microsoft released multiple security updates to a range of products in its 12 October 2021 patch release. The ACSC recommends that all vulnerabilities identified in the release should be mitigated as outlined in the ACSC’s Assessing Security Vulnerabilities and Applying Patches. The vulnerabilities identified affect a wide range of Microsoft Office versions and other applications which handle Microsoft Office files. The ACSC wishes to draw particular attention to the following vulnerabilities for priority consideration:

CVE-2021-26427: Microsoft Exchange Server Remote Code Execution Vulnerability.

CVE-2021-40486: Microsoft Word Remote Code Execution Vulnerability.

CVE-2021-40487 and CVE-2021-41344: Microsoft SharePoint Server Remote Code Execution Vulnerabilities.

Mitigation / How do I stay secure?

Australian organisations and users of utilise Microsoft products should review Microsoft’s security update guide and identify and apply relevant security updates for their environment. Australian organisations and users who utilise Microsoft Exchange Server, Microsoft Office Word or Microsoft SharePoint should review the vulnerabilities listed above as a priority and apply the available patch from Microsoft.

Assistance / Where can I go for help?

/Public Release. This material comes from the originating organization/author(s)and may be of a point-in-time nature, edited for clarity, style and length. The views and opinions expressed are those of the author(s).View in full here.