Patch days / September 2021

Microsoft Patch Tuesday — September 2021

Tuesday, 14 September 2021

Vulnerabilities: 61
Critical: 1
High: 43
Zero-days: 0
Public exploit: 5

Exploited 7

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

Critical 9.8
CVE-2021-38647 Exploited Public exploit Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
EPSS 100%
High 8.8
CVE-2021-40444 Exploited Public exploit Microsoft MSHTML Remote Code Execution Vulnerability
EPSS 98%
High 7.8
CVE-2021-38648 Exploited Public exploit Open Management Infrastructure Elevation of Privilege Vulnerability
EPSS 11%
High 7.8
CVE-2021-36955 Exploited Public exploit Windows Common Log File System Driver Elevation of Privilege Vulnerability
EPSS 4.1%
High 7.8
CVE-2021-38645 Exploited Open Management Infrastructure Elevation of Privilege Vulnerability
EPSS 2.7%
High 7.8
CVE-2021-38646 Exploited Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
EPSS 8%
High 7.0
CVE-2021-38649 Exploited Open Management Infrastructure Elevation of Privilege Vulnerability
EPSS 2.9%

Public exploit code 1

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

High 7.8
CVE-2021-38639 Public exploit Win32k Elevation of Privilege Vulnerability
EPSS 1.4%

All vulnerabilities 61

Critical1 Show

Critical 9.8
CVE-2021-38647 Exploited Public exploit Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
EPSS 100%

High43 Show

High 8.8
CVE-2021-40444 Exploited Public exploit Microsoft MSHTML Remote Code Execution Vulnerability
EPSS 98%
High 7.8
CVE-2021-38648 Exploited Public exploit Open Management Infrastructure Elevation of Privilege Vulnerability
EPSS 11%
High 7.8
CVE-2021-36955 Exploited Public exploit Windows Common Log File System Driver Elevation of Privilege Vulnerability
EPSS 4.1%
High 7.8
CVE-2021-38645 Exploited Open Management Infrastructure Elevation of Privilege Vulnerability
EPSS 2.7%
High 7.8
CVE-2021-38646 Exploited Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
EPSS 8%
High 7.0
CVE-2021-38649 Exploited Open Management Infrastructure Elevation of Privilege Vulnerability
EPSS 2.9%
High 8.8
CVE-2021-36954 Windows Bind Filter Driver Elevation of Privilege Vulnerability
High 8.8
CVE-2021-36965 Windows WLAN AutoConfig Service Remote Code Execution Vulnerability
EPSS 4.7%
High 8.1
CVE-2021-26435 Windows Scripting Engine Memory Corruption Vulnerability
EPSS 5.4%
High 8.0
CVE-2021-36967 Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability
High 7.8
CVE-2021-38639 Public exploit Win32k Elevation of Privilege Vulnerability
EPSS 1.4%
High 7.8
CVE-2021-26434 Visual Studio Elevation of Privilege Vulnerability
High 7.8
CVE-2021-36952 Visual Studio Remote Code Execution Vulnerability
EPSS 51%
High 7.8
CVE-2021-36963 Windows Common Log File System Driver Elevation of Privilege Vulnerability
EPSS 1.2%
High 7.8
CVE-2021-36964 Windows Event Tracing Elevation of Privilege Vulnerability
High 7.8
CVE-2021-36966 Windows Subsystem for Linux Elevation of Privilege Vulnerability
High 7.8
CVE-2021-36968 Windows DNS Elevation of Privilege Vulnerability
High 7.8
CVE-2021-36973 Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability
High 7.8
CVE-2021-36974 Windows SMB Elevation of Privilege Vulnerability
High 7.8
CVE-2021-36975 Win32k Elevation of Privilege Vulnerability
EPSS 1.3%
High 7.8
CVE-2021-38625 Windows Kernel Elevation of Privilege Vulnerability
High 7.8
CVE-2021-38626 Windows Kernel Elevation of Privilege Vulnerability
High 7.8
CVE-2021-38628 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
High 7.8
CVE-2021-38630 Windows Event Tracing Elevation of Privilege Vulnerability
High 7.8
CVE-2021-38633 Windows Common Log File System Driver Elevation of Privilege Vulnerability
EPSS 1%
High 7.8
CVE-2021-38638 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
High 7.8
CVE-2021-38644 Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability
EPSS 2.3%
High 7.8
CVE-2021-38653 Microsoft Office Visio Remote Code Execution Vulnerability
EPSS 6.4%
High 7.8
CVE-2021-38654 Microsoft Office Visio Remote Code Execution Vulnerability
EPSS 6.4%
High 7.8
CVE-2021-38655 Microsoft Excel Remote Code Execution Vulnerability
EPSS 6.4%
High 7.8
CVE-2021-38656 Microsoft Word Remote Code Execution Vulnerability
EPSS 6.7%
High 7.8
CVE-2021-38658 Microsoft Office Graphics Remote Code Execution Vulnerability
EPSS 6.4%
High 7.8
CVE-2021-38659 Microsoft Office Graphics Remote Code Execution Vulnerability
EPSS 6.4%
High 7.8
CVE-2021-38660 Microsoft Office Graphics Remote Code Execution Vulnerability
EPSS 2.3%
High 7.8
CVE-2021-38661 HEVC Video Extensions Remote Code Execution Vulnerability
EPSS 2.3%
High 7.8
CVE-2021-38667 Windows Print Spooler Elevation of Privilege Vulnerability
High 7.8
CVE-2021-38671 Windows Print Spooler Elevation of Privilege Vulnerability
High 7.8
CVE-2021-40447 Windows Print Spooler Elevation of Privilege Vulnerability
High 7.6
CVE-2021-38650 Microsoft Office Spoofing Vulnerability
EPSS 1.6%
High 7.6
CVE-2021-38651 Microsoft SharePoint Server Spoofing Vulnerability
EPSS 1.3%
High 7.6
CVE-2021-38652 Microsoft SharePoint Server Spoofing Vulnerability
EPSS 1.3%
High 7.5
CVE-2021-36960 Windows SMB Information Disclosure Vulnerability
EPSS 3.3%
High 7.1
CVE-2021-38634 Microsoft Windows Update Client Elevation of Privilege Vulnerability

Medium17 Show

Medium 6.5
CVE-2021-38624 Windows Key Storage Provider Security Feature Bypass Vulnerability
EPSS 1.5%
Medium 6.5
CVE-2021-38629 Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability
EPSS 2.7%
Medium 6.4
CVE-2021-38669 Microsoft Edge (Chromium-based) Tampering Vulnerability
EPSS 2.9%
Medium 6.3
CVE-2021-40448 Microsoft Accessibility Insights for Android Information Disclosure Vulnerability
EPSS 3.2%
Medium 6.1
CVE-2021-38657 Microsoft Office Graphics Component Information Disclosure Vulnerability
Medium 5.7
CVE-2021-38632 Windows BitLocker Security Feature Bypass Vulnerability
Medium 5.5
CVE-2021-26437 Visual Studio Code Spoofing Vulnerability
EPSS 2.3%
Medium 5.5
CVE-2021-36959 Windows Authenticode Spoofing Vulnerability
EPSS 1.3%
Medium 5.5
CVE-2021-36961 Windows Installer Denial of Service Vulnerability
EPSS 1.1%
Medium 5.5
CVE-2021-36962 Windows Installer Information Disclosure Vulnerability
EPSS 1.3%
Medium 5.5
CVE-2021-36969 Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
Medium 5.5
CVE-2021-36972 Windows SMB Information Disclosure Vulnerability
Medium 5.5
CVE-2021-38635 Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
Medium 5.5
CVE-2021-38636 Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
Medium 5.5
CVE-2021-38637 Windows Storage Information Disclosure Vulnerability
Medium 5.4
CVE-2021-40440 Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
EPSS 1.1%
Medium 4.4
CVE-2021-36956 Azure Sphere Information Disclosure Vulnerability