As part of August’s Patch Tuesday, Microsoft made fixes for 93 security vulnerabilities available. 29 issues are critical, including four remote code-execution (RCE) flaws in Remote Desktop Services (RDS) and one critical RCE bug in Microsoft Word. Two of the RDS flaws stand out in particular, as they are “wormable,” meaning that they could be exploited in order to carry out an attack involving self-replicating code, like the WannaCry ransomware worm that caused global mayhem in 2017.
According to Microsoft, the two wormable flaws (tracked as (CVE-2019-1181 and CVE-2019-1182) are no less dangerous than the BlueKeep vulnerability that was patched in May of this year, but that still puts hundreds of thousands of devices at risk. Trend Micro’s Zero Day Initiative (ZDI) on Tuesday warned that the four critical RDS vulnerabilities all “receive Microsoft’s highest exploitability ranking, meaning we could likely see multiple RDP exploits circulating in the near future.”
Read more: Shades of BlueKeep: Wormable Remote Desktop Bugs Top August Patch Tuesday List
