Patch Tuesday was anything but typical in the month of May. On May 8, Microsoft released security patches for a total of 67 vulnerabilities, addressing 21 critical vulnerabilities, 42 important and four low-severity, while Adobe addressed a critical flaw in Adobe Flash Player. This is a big push from Microsoft in securing Windows, coming right after the recent release of Windows 10, version 1803, which added several security improvements, among other feature updates. However, what makes this update particularly important is that it addresses two zero-day vulnerabilities that are being actively exploited in the wild and a further two for which public exploits have been published. The first critical vulnerability is the Internet Explorer (IE) Double Kill vulnerability (CVE-2018-8174), which Tenable reported on in April 2018. The second zero-day is CVE-2018-8120, a privilege escalation vulnerability within the Win32k component. Microsoft also patched CVE-2018-8141 (Windows kernel information disclosure vulnerability) and CVE-2018-8170 (Windows image elevation of privilege vulnerability). Technical details, including exploits for both of these CVEs are public, but attackers don't seem to be taking advantage of them at the time of writing this post. A patch for a critical Adobe Flash Player vulnerability (CVE-2018-4944) was also released as part of Adobe’s Patch Tuesday update. Impact assessment For anyone running Windows 10, all but one of the CVEs pose a considerable risk and represent an urgent security concern. These can lead to full system compromise if left unmitigated. One zero-day, IE Double Kill, affects the current version of IE and other applications that use the browser. The other zero-day is the Win32k privilege escalation vulnerability that impacts Windows 7 and Server 2008 users. Both zero-day vulnerabilities permit privilege escalation and full system compromise if exploited. Vulnerability details Microsoft’s May security release includes security updates for the following applications: Internet Explorer Microsoft Edge Microsoft Windows Microsoft Office and Microsoft Office Services and Web Apps ChakraCore Adobe Flash Player .NET Framework Microsoft Exchange Server Windows Host Compute Service Shim The most critical fixes in this security update are for Internet Explorer and Microsoft Windows. Also contained within the update are several patches for Office, Outlook and SharePoint rated as important. An Exchange update and the .NET Framework also have a couple of patches rated Important. CVE-2018-8174, aka “IE Double-kill”, is being actively exploited in the wild. Additional details on this vulnerability can be found here. This is an extremely dangerous vulnerability, as it not only targets the browser, but also affects ActiveX controls and embedded scripts in Office documents. Until a patch has been applied, attackers can potentially force Internet Explorer to load, even if IE is not the default browser. CVE-2018-8120, a privilege escalation vulnerability within the Win32k component, is also being actively exploited in the wild and is rated as “Important.” It only affects Windows 7, Windows Server 2008 and Windows Server 2008 R2. Urgently required actions Due to public exploit availability and the active exploitation of these vulnerabilities, we recommend that users urgently install the security updates to protect themselves. Tenable has the following Nessus plugins for detection of the vulnerabilities for CVE-2018-8174, CVE-2018-8120, CVE-2018-8141 and CVE-2018-8170. Plugin ID Description 109604 KB4103712: Windows 7 and Windows Server 2008 R2 May 2018 Security Update 109610 KB4103726: Windows Server 2012 May 2018 Security Update 109607 KB4103715: Windows 8.1 and Windows Server 2012 R2 May 2018 Security Update 109606 KB4103723: Windows 10 Version 1607 and Windows Server 2016 May 2018 Security Update 109608 KB4103727: Windows 10 Version 1709 May 2018 Security Update 109611 KB4103716: Windows 10 May 2018 Security Update 109605 KB4103721: Windows 10 Version 1803 May 2018 Security Update 109603 KB4103731: Windows 10 Version 1703 May 2018 Security Update Get more information: Microsoft Security TechCenter Adobe Security Bulletin Learn more about Tenable.io®, the first Cyber Exposure platform for holistic management of your modern attack surface Get a free 60-day trial of Tenable.io Vulnerability Management