Three of these vulnerabilities (CVE-2020-17132, CVE-2020-17117, and CVE-2020-17142) existed in the Microsoft Exchange Server. While Microsoft confirmed that exploitation required authenticated access. However, it means that hacking an otherwise legit email account could allow an adversary to take over the Exchanger Server.
Similarly, another critical bug (CVE-2020-17095), could allow an adversary to gain elevated privileges from a Hyper-V guest role to execute codes on Hyper-V host via invalid vSMB packet data. The vulnerability has received a CVSS score of 8.5.
Some of these included Windows Backup Engine, Microsoft SharePoint, Microsoft Excel, Microsoft Outlook, PowerPoint, Windows Error Reporting, and Visual Studio Code. Upon exploitation, the vulnerabilities could lead to remote code execution, information disclosure, privilege escalation, and spoofing.
Apart from these, Microsoft fixed three moderate severity bugs in Azure SDK for Java, Microsoft Edge for Android, and Microsoft SharePoint.
For all of these flaws, fortunately, Microsoft has confirmed no public disclosure or exploitation before the patches. It means that the bugs remained under the radar of the threat actors.
However, now that the flaws are disclosed, all users must ensure updating their systems with the latest Windows updates. Also, users of Microsoft Edge browser should ensure updating it on their Android devices to fix the vulnerability (CVE-2020-17153).
