March Patch Tuesday Fixes 84 Vulnerabilities Across 15 Products

What Happened

On March Patch Tuesday, Microsoft rolled out 84 patches affecting 15 different product families. Among these, eight vulnerabilities were classified as Critical severity. However, it's noteworthy that none of these critical issues affect Windows directly, which is a relief for many users. Microsoft has indicated that these vulnerabilities are not expected to be exploited within the next 30 days, providing a window for users to apply the necessary updates.

Interestingly, five of the eight critical vulnerabilities were addressed prior to Patch Tuesday, showcasing Microsoft’s proactive approach. This month’s patch set includes a variety of vulnerabilities, with 22 having a CVSS base score of 8.0 or higher, indicating their potential severity. One vulnerability even scored a staggering 9.8, marking it as particularly concerning.

Who's Affected

The vulnerabilities patched this month span a wide range of Microsoft products, including lesser-known software that many users may not even be aware of. For instance, the Microsoft Devices Pricing Program and Payment Orchestrator Service were among those affected by critical vulnerabilities. This highlights that even if you don't use Windows, you could be impacted by vulnerabilities in other Microsoft services.

Moreover, the vulnerabilities include various types of risks such as Denial of Service, Elevation of Privilege, and Remote Code Execution. This broad scope means that many organizations relying on Microsoft products should take note of these updates to ensure their systems remain secure.

Patch Status

Microsoft has provided a detailed list of patches, sorted by severity and product family. The company has also noted that six CVEs are considered more likely to be exploited in the coming weeks. Users are encouraged to apply these patches as soon as possible to mitigate risks. Notably, the vulnerabilities affecting Microsoft Office have been highlighted, particularly those related to Remote Code Execution, which could allow attackers to execute malicious code on a user's machine.

For those using Sophos protections, specific vulnerabilities have been flagged as detectable, which can help organizations bolster their defenses against potential exploitation. It’s crucial for users to stay informed about which patches apply to their systems and to act promptly.

Immediate Actions

To protect yourself, ensure that your systems are updated with the latest patches released by Microsoft. Here are some recommended actions:

• Check for Updates: Regularly check for updates through the Windows Update Catalog to ensure you have the latest security patches.
• Implement Sophos Protections: If you're using Sophos, verify that your protections are active and updated to detect the vulnerabilities patched this month.
• Educate Your Team: Make sure your IT team is aware of these vulnerabilities and understands how to apply the necessary patches effectively.

By taking these steps, you can minimize the risk of exploitation and maintain a secure environment in your organization.