A total of 97 vulnerabilities were resolved in April’s patch Tuesday updates from Microsoft this week, including 7 critical severity flaws, and an actively exploited zero-day flaw with a publicly disclosed exploit.  

Critical severity flaw CVE-2023-28250 has a CVSS base score of 9.8 and is found in the Windows pragmatic general multicast (PGM) protocol. This remote code execution vulnerability is not currently known to be exploited, with exploitation less likely now it has been patched in the latest software release. For an attacker to be able to exploit this flaw, the Windows Message Queuing service must be enabled on the target device. An unauthorised attacker can then send a crafted file over the network to remotely execute malicious code.  

Another Microsoft message queuing (MSMQ) vulnerability patched in these updates was CVE-2023-21554. This flaw is also rated as critical severity, with a CVSS base score of 9.8/10. This vulnerability can also be exploited by a remote, unauthenticated attacker, who sends a malicious MSMQ packet to the vulnerable server, which can result in remote code execution on the server side. To mitigate these flaws, administrators can check if the Message Queuing service is running, and if TCP port 1801 is listening on the machine, both of which can be disabled as a temporary fix until the new updates can be applied. 

The other critical severity vulnerabilities patched in these updates are also all remote code execution flaws. CVE-2023-28231 affects the DHCP Server Service, CVE-2023-28219 and CVE-2023-28220 are found in the Windows Layer 2 Tunnelling Protocol, CVE-2023-28232 affects the Windows Point-to-Point Tunnelling Protocol, and CVE-2023-28291 affects Windows Raw Image Extension. 

 The actively exploited zero-day vulnerability that has been patched in these updates is tracked as CVE-2023-28252, has been rated ‘important’ by Microsoft, with a CVSS base score of 7.8/10. This vulnerability occurs within the Windows common log file system driver. Microsoft Defender for Endpoint has notified customers that this flaw has a publicly disclosed exploit, however this is not currently confirmed by the security update guide on Microsoft Security Research Center. An attacker who exploits this elevation of privilege vulnerability can gain SYSTEM level privileges.  

Users should update to the latest Microsoft and Windows releases as soon as possible to apply the latest security patches. The Microsoft security update guide lists the most recent updates that are available for each product, including download links and relevant CVE details.