Security Experts:

Connect with us

Hi, what are you looking for?



Microsoft Patches Actively Exploited Windows Vulnerability

Microsoft’s Patch Tuesday updates for November 2018 address more than 60 vulnerabilities, including zero-days and publicly disclosed flaws.

Microsoft’s Patch Tuesday updates for November 2018 address more than 60 vulnerabilities, including zero-days and publicly disclosed flaws.

Researchers at Kaspersky Lab informed Microsoft of a privilege escalation vulnerability in Windows that has been actively exploited by malicious actors. The flaw, tracked as CVE-2018-8589, allows an attacker to execute arbitrary code in the context of the local user. The issue, caused due to the way Windows handles calls to Win32k.sys, only affects Windows 7 and Windows Server 2008.

Since exploitation requires authentication, threat actors are likely exploiting the flaw in combination with another vulnerability or stolen credentials. Kaspersky will soon share additional details about the security hole and the attacks.

Last month, Microsoft patched another zero-day reported by Kaspersky. That flaw, identified as CVE-2018-8453, had been exploited by the threat group known as FruityArmor in a highly targeted campaign.

Microsoft has also patched a privilege escalation vulnerability disclosed last month by a researcher who uses the online moniker SandboxEscaper.

The weakness, identified as CVE-2018-8584, is related to the Advanced Local Procedure Call (ALPC), and Microsoft says an authenticated attacker can use it to elevate privileges and take control of a vulnerable system. Windows 10 and recent versions of Windows Server are impacted.

A proof-of-concept (PoC) exploit published by SandboxEscaper when the flaw was disclosed deletes files from the system and causes it to crash. The researcher has published a blog post describing how the issue was discovered.

The researcher previously disclosed an unpatched Windows vulnerability which ended up being exploited in attacks by a threat group tracked as PowerPool. Microsoft learned about both vulnerabilities through public disclosure.

Microsoft also resolved a disclosed vulnerability that allows an attacker with physical access to a system to bypass BitLocker device encryption. The tech giant says this issue is not related to research on flawed SSD encryption, for which it recently published an advisory.

Nearly a dozen of the vulnerabilities patched this month are critical, including several memory corruption bugs affecting Internet Explorer and Edge, and remote code execution flaws in the Windows Deployment Services TFTP server, graphics components, and the VBScript engine.

Adobe’s Patch Tuesday updates address vulnerabilities in Flash Player, Acrobat and Reader, and Photoshop. The flaw patched in Acrobat and Reader is the most interesting as a PoC exploit is publicly available.

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.