On Patch Tuesday in April, Microsoft released updates fixing one actively exploited zero-day vulnerability and 97 other flaws. 7 of them are critical because they allow remote code execution, which is the most dangerous violation.

Number of errors in each category:

• 20 privilege escalation vulnerabilities;
• 8 security bypass vulnerabilities;
• 45 remote code execution vulnerabilities (RCE);
• 10 information disclosure vulnerabilities;
• 9 denial of service vulnerabilities (Denial of Service, DoS);
• 6 vulnerabilities that allow spoofing.

The updates also fix one 0day vulnerability that is actively exploited in attacks. CVE-2023-28252 is a privilege escalation vulnerability contained in the Windows Common Log File System (CLFS) driver.

RCE vulnerabilities were also fixed in:

Since RCE vulnerabilities are of high value in phishing campaigns, attackers are likely to try to figure out how they can be used in malicious campaigns. Therefore, Microsoft Office users are strongly advised to install security updates as soon as possible.

BleepingComputer specialists have compiled a complete list of fixes and vulnerabilities descriptions, which can be viewed on this page .

Updates from other companies

Other vendors that released updates in April:

Previously a vulnerability has been discovered in Microsoft Azure Pipelines, allowing attackers to inject malicious code into development workflows and launch attacks on the software supply chain.