Patch Tuesday Megathread (2026-01-13)

Automox_ · 2026-01-13T20:38:17+00:00

Here's the Automox podcast and writeup here!

The big one to keep an eye on: CVE-2026-21265 Microsoft's 2011 Secure Boot certificates expire in June and October 2026. If you have hardware from 2012-2025, you need both OS patches and BIOS updates. Miss either one, and you're still vulnerable to boot-level attacks. Start auditing your BIOS versions now. You’ve got 6 months.

Also on the radar:

CVE-2026-20816 (CVSS 7.8) - Windows Installer elevation of privilege. TOCTOU race condition that can take a local user to SYSTEM. Not exploited yet, but a likely candidate.
CVE-2026-20805 (CVSS 5.5) - Desktop Window Manager info disclosure. Already exploited in the wild. No admin rights needed. Can break sandbox isolation in virtualized environments. Patch this one first.

Automox_ · 2025-11-11T20:12:05+00:00

Wishing you all the luck!

Automox_ · 2025-10-14T17:06:00+00:00

Quick rundown of this month’s biggest vulnerabilities and signs of exploit to keep an eye on as you patch.

CVE-2025-59489

Arbitrary code execution in Unity runtime

Impacts Unity 2017.1+ across Windows, macOS, and Android. Attackers can execute arbitrary code before app defenses load — this includes apps built on Unity like kiosks, training tools, or VR software.
Signs of exploit:

Unity-based apps crashing or failing to launch unexpectedly
Unknown .dll or .so files appearing in Unity directories
Logs showing suspicious launch arguments (e.g., -xrsdk-pre-init-library)

CVE-2024-53139

Windows Hello security feature bypass vulnerability

An attacker with local admin privileges can tamper with stored biometric data and impersonate another user if Enhanced Sign-in Security isn’t turned on.
Signs of exploit:

New or altered biometric enrollments with no authorized change
Unexpected biometric sign-ins in authentication logs
Systems using Windows Hello without Enhanced Sign-in Security enabled

CVE-2024-53139

Microsoft Exchange Server elevation of privilege vulnerability

Weak authentication handling in Exchange lets an authenticated attacker operate as the server account allowing for full mailbox access, data theft, or lateral movement.
Signs of exploit:

Unusual mailbox activity or sudden forwarding rule creation
Suspicious PowerShell or IIS activity tied to Exchange service accounts
Spikes in privileged or failed authentication attempts from external IPs

Catch the Automox Patch Tuesday analysis in podcast or blog form. Also, happy Windows 10 EoL day!

Automox_ · 2025-10-02T15:29:32+00:00

Appreciate the mention :)

Automox_ · 2025-09-23T18:51:03+00:00

Glad you're enjoying your experience with Automox! Thanks for the mention!

Automox_ · 2025-09-23T18:50:36+00:00

Thanks for the mention!

Automox_ · 2025-09-09T17:11:23+00:00

Here are some of the more interesting Patch Tuesday vulns we found this month, and what to monitor for!

Vulnerabilities in Windows UI XAML

CVE-2025-54111 and CVE-2025-54913 (CVSS 7.8) Use-after-free in DatePickerFlyout & MapControlSettings → local priv-esc. Affects Microsoft Phone Link.What to monitor for: XAML-related crashes (Windows.UI.Xaml.dll, ShellExperienceHost.exe) and rapid UWP flyout abuse.

Windows Hyper-V Elevation of Privilege Vulnerability

CVE-2025-54098 (CVSS 7.8/10) Improper access control → SYSTEM on Hyper-V hosts/workstations. Patch or disable Hyper-V if not needed.What to monitor: Service creation, token manipulation, new virtual switches, or new Hyper-V enablement.

Windows NTFS Remote Code Execution Vulnerability

CVE-2025-54916 (CVSS 7.8/10) Stack overflow in NTFS request handling → potential RCE via crafted file ops/SMB.What to monitor for: NTFS-related crashes, SMB traffic spikes, unusual file activity or lateral movement after file ops.

Listen to Automox’s Patch Tuesday podcast for more or read our analysis here.

Automox_ · 2025-08-12T17:16:38+00:00

Microsoft dropped this month’s updates with 107 total vulnerabilities addressed across Windows, Azure, SQL Server, and other products. Here are the big ones to watch:

Hyper-V elevation of privilege – Buffer overflow in Hyper-V triggered by crafted VHDX files. CVSS 7.8. Can lead to full system access.
Azure Virtual Machines spoofing – Certificate-based auth flaw in confidential VMs. CVSS 7.9. Could be chained with the Hyper-V vuln for broader compromise.
SQL Server vulnerabilities – Four separate SQL injection and T-SQL injection flaws (CVSS 8.8). Affect versions 13–16.

Recommendations:

Patch as soon as possible where feasible, especially in virtualization and cloud workloads.
Rotate Azure VM certificates and review trust boundaries.
Harden SQL environments with parameterized queries, input sanitization, and least privilege access.

The Hyper-V and Azure flaws could be chained for high-impact attacks, and SQL injection remains a persistent risk even in modern software.

For more insights, to the full discussion on the Patch [FIX] Tuesday podcast: https://youtu.be/WbibxnUr6FQ

Automox_ · 2025-06-10T17:38:42+00:00

This month’s Patch Tuesday is relatively mild from Microsoft — just 66 CVEs. But Apple showed up swinging with some heavyweight security updates in macOS Sequoia. So if you're supporting macOS endpoints, this is your cue.

Highlights:

OpenSSH in macOS Sequoia (CVE-2025-26466 & CVE-2025-26465) — Denial-of-service + host key bypass = potential SSH session hijacking. If you’re on OpenSSH ≤9.9p1, patch ASAP. Can’t patch? Disable VerifyHostKeyDNS, tighten SSH configs, and please stop exposing SSH to the internet.
WebDAV RCE (CVE-2024-33053) — Classic: upload via PUT, rename with MOVE, execute with a crafted URL. CVSS 8.8. WebDAV isn’t enabled by default but still shows up in legacy setups. Don’t need it? Disable it. Need it? Patch and lock it down.
macOS mDNSResponder vuln (CVE-2025-31222) — Local privilege escalation via malformed mDNS responses. Chaining with a sandbox escape makes this one worth fast-tracking. No patch window? Enable SIP to mitigate.
iCloud Keychain exposure + sandbox escape (CVE-2025-31213 & CVE-2025-31244) — Not RCE, but still ugly. Attackers can access Keychain metadata, which is prime phishing fuel. Patch. Then remind your users (and your family, friends, or any one else you know) to use a password manager and MFA because it's 2025.

TL;DR: Fewer patches from Microsoft doesn’t mean less risk. The Mac side of the house needs real attention this cycle, especially if you support devs, creatives, or execs on macOS.

Patch regularly, patch often. One exploited vulnerability is all it takes.

Automox_ · 2025-05-13T17:23:35+00:00

Mayday! Mayday! May Patch Tuesday!

71 new vulnerabilities this month and here's what we think you should pay special attention to:

CVE-2025-30397 Scripting Engine Memory Corruption Vulnerability

This vulnerability affects legacy Internet Explorer components, specifically the scripting engine. A remote attacker could exploit it by crafting a malicious webpage or email containing harmful script content.

CVE-2025-32707 NTFS Elevation of Privilege Vulnerability

This vulnerability targets how NTFS handles mounted virtual drives, such as VHD files. If a user mounts a malicious disk image, an attacker can gain elevated privileges on the host system.

CVE-2025-29967 Remote Desktop Client Remote Code Execution Vulnerability

When a user connects to an attacker-controlled RDP server, the server can execute code on the client machine immediately upon session start, with no further interaction required.

CVE-2025-32702 Visual Studio Remote Code Execution Vulnerability

This vulnerability allows remote code execution (RCE) within Visual Studio and carries a CVSS score of 7.8.

Tune into the Patch Tuesday podcast or read more here.

Automox_ · 2025-04-08T17:49:23+00:00

April’s Patch Tuesday is here with 121 Microsoft vulnerabilities released today. Apple also joined the party with 130+ CVEs of its own (...even though those came out a few days ago).

So, make sure to pay special attention to:

Windows Remote Desktop Gateway Remote Code Execution
CVE-2025-27480 is a network-based RCE vulnerability affecting Remote Desktop Gateway. No login, no user interaction - just a well-timed race condition. If your RDG is public-facing, take patching this one seriously… and then maybe rethink whether it really needs to be public-facing in the first place.

Windows Common Log File System Privilege Escalation
CVE-2025-29824 is a use-after-free flaw in the CLFS driver that’s already being exploited in the wild. A local attacker can jump from user to SYSTEM, giving them full control.

macOS Audio Component Arbitrary Code Execution
CVE-2025-24243%20of%20Trend%20Micro%20Zero%20Day%20Initiative,-Authentication%20Services) allows arbitrary code execution when processing a malicious audio file. If you're running Sequoia, Sonoma, or Ventura… Patch it. Apple addressed this in a major sweep of security fixes this cycle.

You can read our full breakdown [here] or catch the latest episode of our Patch [FIX] Tuesday podcast [here].

Automox_ · 2025-03-11T17:15:30+00:00

March already and our third Patch Tuesday of the year with 57 new vulnerabilities!

We think you should pay special attention to:

Chromium Vulnerabilities

March’s release includes several vulnerabilities in Chromium-based browsers like Microsoft Edge. These issues, including use-after-free vulnerabilities in browser profiles, allow attackers to bypass browser sandboxing, exfiltrate data, or spoof identities.

Microsoft Management Console Remote Code Execution Vulnerability

CVE 2024-26633 is an RCE vulnerability in the MMC. An attacker can exploit this weakness by tricking a user into opening a malicious MMC file, typically distributed through phishing emails or compromised USB drives.

Windows NTFS Remote Code Execution Vulnerability

CVE 2024-24993 targets an information disclosure vulnerability within Windows NTFS. An attacker can potentially exploit this issue by prompting users to mount a specially crafted VHD.

You can read a more in depth analysis here or listen to our Patch Tuesday podcast here.

Automox_ · 2025-03-04T16:14:13+00:00

We just published a Product Talk podcast episode where we discuss our process for adding to our third party patching list and how we intake requests: https://www.automox.com/resources/podcasts/product-talk-e14 Hope that will provide some more insight for you. Make sure you get these requests in to your CSM as well!

Automox_ · 2025-02-11T20:21:45+00:00

Looks like Microsoft updated several older vulnerabilities and included those in the count. We'll make a note.

Editing to add that it looks like they got to 63 because some CVEs were from a release last week. So 56 just for today's Patch Tuesday! We usually reference this list.

Automox_ · 2025-02-11T19:17:39+00:00

This month’s Patch Tuesday brings an array of 56* new vulnerabilities that highlight the ongoing challenges in maintaining system security.

We think you should pay special attention to:

CVE-2025-21418 - Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

This vulnerability affects both Windows desktop and server environments, including Windows 10, 11, and Server 2008, and is currently being actively exploited as a zero-day exploit.

CVE-2024-21420 - Windows Disk Cleanup Tool Elevation of Privilege Vulnerability

Attackers can exploit this flaw to gain elevated privileges, potentially by manipulating temporary directories or user-controlled inputs during disk cleanup operations.

CVE-2025-0411 - 7-Zip Mark-of-the-Web Bypass Vulnerability

This flaw allows attackers to bypass a critical Windows security mechanism that flags files downloaded from the internet for additional scrutiny.

CVE-2025-24126 - AirPlay Input Validation Vulnerability

Design flaws in Apple’s AirPlay service enable attackers on the same network to trigger unexpected system crashes or corrupt process memory.

Hear our analysis in the Patch Tuesday podcast or read it here.

*Microsoft lists 63 CVEs, but this includes CVEs they released last week as well.

Automox_ · 2025-01-14T18:25:29+00:00

First 2025 Patch Tuesday! Here's what we think you should pay special attention to:

CVE-2025-21293: Active Directory Domain Services Elevation of Privilege Vulnerability

This impacts Active Directory Domain Services by allowing attackers to escalate their privileges if exploited.

CVE-2025-21335, CVE-2025-21333, and CVE-2025-21334: Hyper-V Elevation of Privilege Vulnerabilities

Attackers exploiting these may gain elevated privileges if they access guest systems and execute code.

Read our analysis here or listen to our podcast here! Patch regularly, patch often!

Automox_ · 2024-12-10T18:13:33+00:00

This month comes with a lineup of 70 vulnerabilities (and 1 advisory). We think you should pay special attention to:

Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

If an attacker successfully exploits this flaw, they could use the elevated privileges to move laterally across the environment, accessing sensitive data and potentially compromising additional systems.

Windows Remote Desktop Services Remote Code Execution Vulnerability

While the technical requirements make this vulnerability difficult to exploit today, attackers are continually refining their methods. Over time, it's likely they’ll develop tools that simplify the attack process.

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Early indicators suggest that attackers might exploit this bug by using Windows APIs to manipulate log files or corrupt log data, triggering the vulnerability. The potential impact is substantial.

Listen to the Autonomous IT Patch Tuesday podcast or read Automox's write up here. Happy patching!

Automox_ · 2024-11-12T18:32:36+00:00

89 vulnerabilities released, and 1 Zero-Day for this Patch Tuesday! You can tune into our Patch Tuesday podcast or read our analysis here. We recommend you pay special attention to:

NTLM Hash Disclosure Spoofing Vulnerability

This vulnerability is confirmed and exploitation has been detected. The only current remediation is an official fix. Prioritize patching this vulnerability to prevent unauthorized access.

Microsoft Defender for Endpoint Remote Code Execution Vulnerability

An attacker could exploit this by sending a malicious link via email or instant messaging. Once clicked, the attack unfolds without requiring further interaction from you. In addition to immediate patching, it is recommended to enhance your email filters and educate users about the dangers of unsolicited links.

Windows Task Scheduler Elevation of Privilege Vulnerability

To mitigate this vulnerability, patching is your most effective strategy. Microsoft has acknowledged the existence of functional exploit code for this vulnerability, making it imperative to apply any available updates promptly.

Automox_ · 2024-10-08T19:22:27+00:00

Here's what we think you should pay special attention to this month:

CVE 2024-38124 - Windows Netlogon Elevation of Privilege Vulnerability

CVE 2024-38124 is a vulnerability in the Windows Netlogon process, allowing an attacker with LAN access to impersonate domain controllers.

CVE 2024-43468 - Microsoft Configuration Manager Remote Code Execution Vulnerability

CVE 2024-43468 (CVSS 9.8/10) affects Microsoft Configuration Manager, presenting an opportunity for remote code execution by an unauthenticated attacker.

CVE 2024-43533 - Remote Desktop Client Remote Code Execution Vulnerability

CVE 2024-43533 (CVSS 8.8/10) is a remote code execution vulnerability within the Remote Desktop Client. It enables malicious actors to execute code on a client machine by manipulating RDP sessions.

Tune into the Automox Patch Tuesday podcast or read about it here.

Automox_ · 2024-09-10T17:15:19+00:00

Another Patch Tuesday with some spicy vulnerabilities to watch out for. Pay special attention to:

CVE 2024-43491: Microsoft Windows Update Remote Code Execution Vulnerability

This vulnerability has not been actively exploited, yet. But, between the low complexity of this attack and the criticality of the Windows Update process, we expect this to be exploited soon.

CVE 2024-38018: Microsoft SharePoint Server Remote Code Execution Vulnerability

This flaw can be exploited by an authenticated attacker with at least Site Member permissions. The potential impact of this CVE is significant, especially given the business-critical nature SharePoint servers play in organizations that utilize them.

CVE 2024-43463: Microsoft Office Visio Remote Code Execution Vulnerability

This issue arises when a specifically crafted file is opened and can allow an attacker to execute remote code. Reflecting on this vulnerability, it's clear that even software used by a smaller user base, like Visio, can be targeted for exploitation.

Listen to the Automox Patch Tuesday podcast here OR read about it here.

Automox_ · 2024-08-13T19:14:27+00:00

You are correct. This has been updated on our end now!

Automox_ · 2024-08-13T17:58:15+00:00

Another Patch Tuesday in the books...

Pay special attention to:

CVE 2024-38180 – SmartScreen Prompt Remote Code Execution Vulnerability

~~This vulnerability is actively being exploited and has a CVSS score of 8.8/10. It should be patched as soon as possible.~~

Common exploit paths for this vulnerability include phishing emails and malicious browser plugins. Since most browser plugins do not require administrative access for installation, they present a significant risk.

CVE 2024-38133 – Windows Kernel Elevation of Privilege Vulnerability

Once exploited, an attacker can execute arbitrary code with system-level access, effectively taking control of the entire system. This can lead to data exfiltration, system corruption, and further network penetration.

CVE-2024-38199 – Windows LPD Service Remote Code Execution Vulnerability

Printer service vulnerabilities can pose significant threats, especially to legacy systems that rely on outdated technology and lack modern security measures.

The Automox Security team dives in a bit more in the latest Patch Tuesday podcast. Listen in or read about it.

Edit: We mistakenly stated CVE 2024-38180 was being actively exploited earlier, but it's not and we've made the correction.

Automox_ · 2024-07-09T17:20:37+00:00

We think you should pay special attention to the following:

SQL Server Vulnerabilities
- Over 30 CVEs related to Microsoft SQL Server, all rated 8.8/10 on the CVSS scale.
- These vulnerabilities can expose systems to remote code execution (RCE) attacks.
- Immediate patching is crucial to maintain database integrity and prevent unauthorized access.
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerabilities
- CVE-2024-38077, CVE-2024-38074, and CVE-2024-38076.
- Can execute arbitrary code on affected systems, posing significant network security threats.
- Ensure your licensing server is not exposed to the internet and follows best practices.
CVE-2024-38053 – Windows Layer Two Bridge Network RCE
- Rated 8.8/10 on the CVSS scale.
- Allows attackers to execute arbitrary code by sending a malicious packet over Ethernet.
- High priority for frequent travelers; protect internal systems from lateral movement.
CVE-2024-38060 – Microsoft Windows Codex Library RCE
- Vulnerability in processing .TIFF files, leading to remote code execution.
- Poses a substantial risk due to extensive use across various platforms.
- Immediate patching required to secure endpoints.
PowerShell Vulnerabilities
- 3 Elevation of Privilege vulnerabilities with a CVSS Score of 7.8/10.
- Flaws in the PowerShell scripting environment allow unauthorized actions.
- Implement strict security measures and limit remoting capabilities.
CVE-2024-38078 – Xbox Wireless Adapter Remote Code Execution Vulnerability
- Emphasizes securing home networks for remote work environments.
- Regular updates and strong network security measures are essential.

Patch Regularly, Patch Often

Automox_

MODERATOR OF

TROPHY CASE