Azure AD Web Sign-in Security Feature Bypass Vulnerability (CVE-2021-27092, Important)

Today, for its April 2021 Patch Tuesday, Microsoft released an important security update for the Azure AD web sign-in feature in Windows and Windows Server. This vulnerability is known as CVE-2021-27092 and rated with CVSSv3.0 scores of 6.8/5.9. About Azure AD Web Sign-in Web Sign-in is a new way of signing into a Windows system. … Continue reading "Azure AD Web Sign-in Security Feature Bypass Vulnerability (CVE-2021-27092, Important)"

On-premises Identity-related updates and fixes for March 2021

Even though Microsoft’s Identity focus moves towards the cloud, they are not forgetting their on-premises roots. Windows Server 2016 and Windows Server 2019 still receive updates. These are the Identity-related updates and fixes we saw for March 2021:   Windows Server 2016 We observed the following update for Windows Server 2016: KB45000803 March 9, 2021 … Continue reading "On-premises Identity-related updates and fixes for March 2021"

The March 2021 Cumulative Update addresses seven Windows Server DNS vulnerabilities

Today, for its March 2021 Patch Tuesday, Microsoft released a security update that addresses seven vulnerabilities in DNS Servers running Windows Server: About the vulnerabilities The vulnerabilities are described as followed:    CVE-2021-26877 Windows DNS Server Remote Code Execution Vulnerability Critical A remote code execution vulnerability, identified as CVE-2021-26877, exists in Windows Domain Name System … Continue reading "The March 2021 Cumulative Update addresses seven Windows Server DNS vulnerabilities"

On-premises Identity-related updates and fixes for February 2021

Even though Microsoft’s Identity focus moves towards the cloud, they are not forgetting their on-premises roots. Windows Server 2016 and Windows Server 2019 still receive updates. These are the Identity-related updates and fixes we saw for February 2021: Windows Server 2016 We observed the following update for Windows Server 2016: KB4601318 February 9, 2021 The … Continue reading "On-premises Identity-related updates and fixes for February 2021"

Older versions of Azure AD Connect will be retired on February 29th, 2024

If you are using an older version of Azure AD Connect, you might want to consider upgrading it. Yesterday, Microsoft published new information on changes to come. The Azure AD Connect product team is constantly making updates to Azure AD Connect Sync to ensure optimal security and performance of organizations’ synchronization processes. Therefore, Microsoft retires … Continue reading "Older versions of Azure AD Connect will be retired on February 29th, 2024"

Windows PKU2U Elevation of Privilege Vulnerability (CVE-2021-25195, Critical)

Yesterday, for its February 2021 Patch Tuesday, Microsoft released a critical security update for PKU2U. This vulnerability is known as CVE-2021-25195 and rated with CVSSv3.0 scores of 7.8/6.8.   About PKU2U Authentication PKU2U is a peer-to-peer authentication protocol. This setting prevents online identities from authenticating to domain-joined systems. Authentication will be centrally managed with Windows … Continue reading "Windows PKU2U Elevation of Privilege Vulnerability (CVE-2021-25195, Critical)"

Windows DNS Server Remote Code Execution Vulnerability (CVE-2021-24078, Critical CVSSv3 9.8/8.5)

Today, for its February 2021 Patch Tuesday, Microsoft released a critical security update for DNS Servers running Windows Server. This vulnerability is known as CVE-2021-24078 and rated with CVSSv3.0 scores of 9.8/8.5. A remote code execution vulnerability exists in Windows Domain Name System (DNS) servers. An attacker who successfully exploited the vulnerability could run arbitrary … Continue reading "Windows DNS Server Remote Code Execution Vulnerability (CVE-2021-24078, Critical CVSSv3 9.8/8.5)"

PFX Encryption Security Feature Bypass Vulnerability (CVE-2021-1731, Important)

Today, for its February 2021 Patch Tuesday, Microsoft released an important security update for certificates in Windows and Windows Server. This vulnerability is known as CVE-2021-1731 and rated with CVSSv3.0 scores of 5.5/4.8. When glancing over the vulnerability, it might not be a particularly important vulnerability, but its implications are wide and deep; This PFX … Continue reading "PFX Encryption Security Feature Bypass Vulnerability (CVE-2021-1731, Important)"

On-premises Identity-related updates and fixes for January 2021

Even though Microsoft’s Identity focus moves towards the cloud, they are not forgetting their on-premises roots. Windows Server 2016 and Windows Server 2019 still receive updates. These are the Identity-related updates and fixes we saw for January 2021:   Windows Server 2016 We observed the following update for Windows Server 2016: KB4598243 January 12, 2021 … Continue reading "On-premises Identity-related updates and fixes for January 2021"

Azure Active Directory Pod Identity Spoofing Vulnerability (CVE-2021-1677)

Today, for its January 2021 Patch Tuesday, Microsoft released an important security update for Azure Active Directory Pod Identities. This vulnerability is known as CVE-2021-1677 and rated with CVSSv3.0 scores of 5.5/4.8 About the vulnerability The Azure AD pod identity feature enables users to assign identities to pods in Kubernetes clusters and fetch them from … Continue reading "Azure Active Directory Pod Identity Spoofing Vulnerability (CVE-2021-1677)"