Impatto Sistemico

Critico (79.35)

Sintesi

Microsoft ha rilasciato gli aggiornamenti di sicurezza mensili che risolvono un totale di 622 nuove vulnerabilità, di cui 2 di tipo 0-day.

Tipologia

• Denial of Service
• Elevation of Privilege
• Information Disclosure
• Remote Code Execution
• Security Feature Bypass
• Spoofing
• Tampering

Descrizione e potenziali impatti

Nel dettaglio le vulnerabilità sfruttate attivamente e/o per alcune delle quali risulta disponibile in rete anche un “proof of concept”, riguardano:

Active Directory Federation Services (AD FS): identificata tramite la CVE-2026-56155, di tipo “Elevation of Privilege” e con score CVSS v3.1 pari a 7.8. Questa vulnerabilità è dovuta a una definizione non adeguata dei permessi nel controllo degli accessi in Active Directory Federation Services (AD FS), che consente a un utente autorizzato di elevare i privilegi localmente. Un attaccante non autenticato potrebbe sfruttare tale vulnerabilità al fine di ottenere privilegi amministrativi sui sistemi interessati.

Microsoft Office SharePoint: identificata tramite la CVE-2026-56164, di tipo “Elevation of Privilege” e con score CVSS v3.1 pari a 5.3. Questa vulnerabilità è dovuta alla mancata autenticazione per funzioni critiche in Microsoft Office SharePoint, che consente a un utente non autorizzato di elevare i privilegi attraverso la rete. Un attaccante remoto potrebbe sfruttare tale vulnerabilità inviando richieste HTTP opportunamente predisposte al dispositivo interessato al fine di ottenere privilegi elevati sul sistema.

Windows BitLocker: identificata tramite la CVE-2026-50661, di tipo “Security Feature Bypass” e con score CVSS v3.1 pari a 6.1. Questa vulnerabilità deriva da un’anomalia presente nel meccanismo di protezione di Windows BitLocker, che consente a un utente non autorizzato di bypassare una funzionalità di sicurezza. Un attaccante con accesso fisico al dispositivo potrebbe sfruttare tale vulnerabilità al fine di eludere il dispositivo di cifratura BitLocker e accedere ai dati protetti.

Prodotti e/o versioni affette

• .NET
• .NET Core
• .NET Framework
• ASP.NET Core
• Active Directory Certificate Services (AD CS)
• Active Directory Domain Services
• Active Directory Federation Services (AD FS)
• Age of Empires II: Definitive Edition Game
• Azure Active Directory
• Azure CycleCloud
• Azure Monitor Agent
• Azure OpenAI
• Azure Spring Apps
• Azure Synapse
• Code Integrity DLL (ci.dll)
• Composite Image File System Driver
• Content Delivery Manager
• Desktop Window Manager
• Extensible Storage Engine (ESENT)
• GitHub Copilot and Visual Studio
• GitHub Copilot and Visual Studio Code
• Github Copilot
• HTTP/2
• M365 Copilot
• Microsoft 365 Copilot for iOS
• Microsoft Bing App for IOS
• Microsoft Configuration Manager
• Microsoft Copilot
• Microsoft Defender
• Microsoft Defender for Endpoint
• Microsoft Dynamics NAV
• Microsoft Edge (Chromium-based)
• Microsoft Edge for Android
• Microsoft Entra Provisioning Service (SyncFabric)
• Microsoft Exchange Online
• Microsoft Exchange Server
• Microsoft Fabric Data Warehouse
• Microsoft Graphics Component
• Microsoft Input Method Editor (IME)
• Microsoft Install Service
• Microsoft NAT Helper Components (ipnathlp.dll)
• Microsoft Office
• Microsoft Office Excel
• Microsoft Office OneNote
• Microsoft Office PowerPoint
• Microsoft Office SharePoint
• Microsoft Office Word
• Microsoft Printer Drivers
• Microsoft Surface
• Microsoft Windows
• Microsoft Windows App Store
• Microsoft Windows Codecs Library
• Microsoft Windows Media Foundation
• Microsoft Windows Search Component
• Microsoft Windows Speech
• Microsoft XML
• Microsoft XML Core Services
• Minecraft Bedrock Dedicated Server
• Outlook Copilot
• Power BI
• Quality Windows Audio/Video Experience (QWAVE) service
• RPC Runtime
• Reliable Multicast Transport Driver (RMCAST)
• Remote Desktop Client
• Role: DNS Server
• SQL Server
• SQL Server ODBC driver
• Universal Plug and Play (upnp.dll)
• Virtual Hard Disk (VHD) Miniport Driver
• Visual Studio
• Visual Studio Code
• Window PC Manager
• Windows Active Directory
• Windows Admin Center
• Windows Ancillary Function Driver for WinSock
• Windows App Installer
• Windows AppX Deployment Service
• Windows Application Model
• Windows Audio Compression Manager (ACM)
• Windows Audio Service
• Windows Backup Engine
• Windows BitLocker
• Windows Bluetooth Port Driver
• Windows Bluetooth Service
• Windows Boot Loader
• Windows Brokering File System
• Windows Client-Side Caching (CSC) Service
• Windows Clip Service
• Windows Clipboard Server
• Windows Clipboard User Service
• Windows Cloud Files Mini Filter Driver
• Windows Common Log File System Driver
• Windows Connected User Experiences and Telemetry
• Windows Container Isolation FS Filter Driver (unionfs.sys)
• Windows CryptoAPI
• Windows Cryptographic Services
• Windows DHCP Client
• Windows DHCP Server
• Windows DNS
• Windows DWM
• Windows DWM Core Library
• Windows Data.dll
• Windows Devices Human Interface
• Windows DirectX
• Windows Domain Controller
• Windows Event Logging Service
• Windows FTP Service
• Windows File Explorer
• Windows File History Service
• Windows Filtering Platform (WFP)
• Windows GDI
• Windows GDI+
• Windows Graphics Kernel
• Windows Group Policy
• Windows HTTP.sys
• Windows Hyper-V
• Windows Image Acquisition
• Windows Installer
• Windows Internal System User Profile
• Windows Internal Task Bar
• Windows Internet Key Exchange (IKE) Protocol
• Windows Kernel
• Windows Kernel Mode Driver
• Windows Kernel-Mode Drivers
• Windows Key Guard
• Windows LUAFV
• Windows Local Security Authority Subsystem Service (LSASS)
• Windows MIDI Service Module
• Windows Management Services
• Windows Media
• Windows Message Queuing
• Windows Message Queuing Queue Manager
• Windows NTFS
• Windows Narrator Braille
• Windows Netlogon
• Windows Network Address Translation (NAT)
• Windows Network File System
• Windows Network Policy Server SNMP
• Windows Notification
• Windows OLE
• Windows Operating Systems
• Windows Overlay Filter
• Windows PowerShell
• Windows Print Spooler Components
• Windows Projected File System
• Windows Push Notifications
• Windows Quality of Service (QoS) Packet Scheduler
• Windows RDP
• Windows RPC API
• Windows Redirected Drive Buffering
• Windows Remote Access Connection Manager
• Windows Remote Access Service Infrastructure
• Windows Remote Desktop Protocol
• Windows Remote Desktop Services
• Windows Remote Help Defense
• Windows Resilient File System (ReFS)
• Windows Routing and Remote Access Service (RRAS)
• Windows Runtime
• Windows SMB
• Windows SMB Server
• Windows SMB Server Network Transport Driver (srvnet.sys)
• Windows Schannel
• Windows Secure Boot
• Windows Secure Kernel Mode
• Windows Secure Socket Tunneling Protocol (SSTP)
• Windows Sensor Data Service
• Windows Server
• Windows Server Backup
• Windows Server Network driver
• Windows Server Update Service
• Windows Spaceport.sys
• Windows StateRepository API
• Windows Storage
• Windows Storage Spaces Direct
• Windows Subsystem for Linux
• Windows System
• Windows TCP/IP
• Windows Telephony Service
• Windows Terminal
• Windows Trusted Runtime Interface Driver
• Windows USB Audio Class driver (usbaudio.sys)
• Windows USB Driver
• Windows USB Hub Driver
• Windows USB Print Driver
• Windows USB Video Driver
• Windows Unified Consent System
• Windows Universal Disk Format File System Driver (UDFS)
• Windows User Interface Core
• Windows VMSwitch
• Windows Virtual Filtering Platform (VFP)
• Windows WalletService
• Windows Web Proxy Auto-Discovery Protocol (WPAD)
• Windows WebView
• Windows Win32K
• Windows Win32K – GRFX
• Windows Wireless Networking
• Windows Wireless Wide Area Network Service

Azioni di mitigazione

In linea con le dichiarazioni del vendor, si raccomanda di procedere all’aggiornamento dei prodotti impattati attraverso l’apposita funzione di Windows Update.