Vulnerabilità · 169 giorni fa

Federal Systems Still Exposed to Decade-Old Microsoft Vulnerabilities

Attackers are exploiting Microsoft vulnerabilities, including one patched nearly 14 years ago, showing that federal systems may still run legacy or unpatched software. This reuse of old flaws reveals gaps in patch management that standard responses often overlook.

CISA added four Microsoft vulnerabilities to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch them within two weeks. These include recent privilege escalation and remote code execution flaws in Windows and Exchange Server, plus a 2012 Visual Basic for Applications vulnerability still actively exploited.

The persistence of attacks leveraging a 2012 vulnerability signals that legacy software remains a critical risk. This trend suggests that patching alone is insufficient if older systems or updates are neglected, leaving federal networks vulnerable to ransomware and data theft.

Cronologia

• 27 apr Scadenza federale CISA per CVE-2023-21529
• 13 apr Segnalato da The Register Security

Fonti

1 fonte che coprono questa storia

• The Register Security 13 apr

  Ransomware scum, other crims exploit 4 old Microsoft bugs

  : One was patched almost 14 years ago

Entità

• CVE-2025-60710
• CVE-2023-36424
• CVE-2023-21529
• CVE-2012-1854

Riepilogo fornitore: Microsoft

Part of the PlainSec briefing for 2026-04-14

Editions

• Briefing for 2026-04-14

Storie correlate

• Malicious PDFs Enable Code Execution Across Windows and macOS
• Zero-Day di Adobe Reader utilizza un fingerprinting furtivo prima della RCE