Microsoft’s October 2023 Patch Tuesday Updates Fix 103 Security Flaws

Key takeaways:

• Microsoft has released the October 2023 Patch Tuesday updates to address a total of 103 security vulnerabilities on Windows PCs.
• The updates come with a range of critical and important patches, addressing various vulnerabilities across Windows, Office, Exchange Server, Azure, Skype for Business, and more.
• Microsoft has officially ended support for Windows Server 2012 and Windows Server 2012 R2, but enterprise customers can still receive security updates through the Extended Security Update (ESU) program until October 13, 2026.

Microsoft announced the release of the October 2023 Patch Tuesday updates for Windows 10 and Windows 11 yesterday. This month, the company has addressed 103 security vulnerabilities, including three actively exploited zero-day flaws affecting Microsoft WordPad, Skype for Business, and the HTTP/2 protocol.

October 2023 Patch Tuesday updates fix over 100 vulnerabilities

In October, Microsoft released a total of 103 patches to address several vulnerabilities in Windows, Office, Exchange Server, Office, Azure, Skype for Business, and other components. 13 of them are rated critical, and there are also 90 security flaws rated “Important” in severity.

Here’s a list of the most important vulnerabilities that were fixed this month:

• CVE-2023-41763: This elevation of privileges vulnerability affects Skype for Business. It could allow threat actors to make malicious calls to a vulnerable Skype for Business server and steal sensitive information. However, the hackers won’t be able to modify the data and restrict access to the affected resource.
• CVE-2023-36563: This is an information disclosure vulnerability in the WordPad word processing program that affects both Windows desktop and server machines. It could enable hackers to expose NTLM hashes and decrypt users’ credentials.
• CVE-2023-35349: The latest update also brings 20 Message Queuing patches, and one of them carries a CVSS critical score of 9.8 out of 10. The security flaw allows unauthenticated remote code execution (RCE) without user interaction.
• CVE-2023-44487: This is an HTTP/2 protocol vulnerability that has been actively exploited by threat actors to launch distributed denial of service (DDoS) attacks. It is a zero-day flaw that impacts several Microsoft products, including Visual Studio 2022, ASP.NET Core 7.0, and .NET 7.0.
• CVE-2023-36434: This is a Windows IIS Server elevation of privilege vulnerability with a 9.8 CVSS score. The security flaw is labeled as important by Microsoft because the hackers need to be on the same corporate network to exploit it. It lets the attackers impersonate another user to log on to a vulnerable IIS server.
• CVE-2023-36778: Microsoft patched a remote code execution vulnerability that targeted the on-premises email platform Exchange Server. However, it requires the attacker to be authenticated with Exchange Server credentials to exploit the flaw through a PowerShell remoting session.

Quality and experience updates

The October 2023 Patch Tuesday Updates bring some minor improvements for users running Windows 11 version 22H2. There is a new feature that lets users view the recommended websites in the Start Menu’s Recommended section. However, IT Pros can configure a policy to disable this feature on managed Windows 11 devices.

Microsoft has released the KB5030310 update to address a couple of bugs that previously caused the taskbar’s search button to disappear while interacting with the search box flyout menu. The company also fixed a Microsoft Defender bug that prevented users from connecting to USB printers on Windows 11 versions 22H2 and 21H2.

Microsoft drops support for Windows Server 2012/2012 R2

Microsoft has officially dropped support for Windows Server 2012 and Windows Server 2012 R2. However, enterprise customers can continue receiving critical and important updates via the Extended Security Update (ESU) program until October 13, 2026.

Microsoft notes that the ESU program requires annual renewals for organizations that purchase through volume licensing. However, it doesn’t require organizations to pay any additional costs to host Windows Server workloads in Azure virtual machines. If you’re interested, you can find more details about the eligibility criteria of the ESU program in this FAQ document.

Windows Update testing and best practices

Organizations looking to deploy this month’s patches should conduct thorough testing before deploying them widely on production systems. That said, applying the patches widely shouldn’t be delayed longer than necessary as hackers start to work out how to weaponize newly reported vulnerabilities.

A best practice is to make sure you have backed up systems before applying updates. Every month, users experience issues with Windows updates that lead to systems not booting, application and hardware compatibility issues, or even data loss in extreme cases.

There are backup tools built into Windows and Windows Server that you can use to restore systems in the event a patch causes a problem. The backup features in Windows can be used to restore an entire system, or files and folders on a granular basis.

If you have any problems with this month’s patches, please let us know in the comments below. Other readers might be able to share their experiences in how to roll back problematic updates or mitigate issues caused by patches that are important to have in place.