Consorzio Metis

CSIRT Toscana

CSIRT Toscana

Aggiornamenti Mensili Microsoft (AL03/211215/CSIRT-ITA)

Data:
7 Ottobre 2025

Impatto Sistemico

Critico (77.76)

Sintesi

Microsoft ha rilasciato gli aggiornamenti di sicurezza mensili che risolvono un totale di 76 vulnerabilità, 6 di tipo 0-day.

Note : la CVE-2021-43890 risulta essere sfruttata attivamente in rete

Note : la CVE-2021-43226 risulta essere sfruttata attivamente in rete

Tipologia

  • Denial of Service
  • Elevation of Privilege
  • Information Disclosure
  • Remote Code Execution
  • Spoofing

Prodotti e versioni affette

  • ASP.NET Core & Visual Studio
  • Azure Bot Framework SDK
  • BizTalk ESB Toolkit
  • Hyper-V
  • Internet Storage Name Service
  • Microsoft Defender for IoT
  • Microsoft Devices
  • Microsoft Edge (Chromium-based)
  • Microsoft Local Security Authority Server (lsasrv)
  • Microsoft Message Queuing
  • Microsoft Office
  • Microsoft Office Access
  • Microsoft Office Excel
  • Microsoft Office SharePoint
  • Microsoft PowerShell
  • Microsoft Windows
  • Microsoft Windows Codecs Library
  • Office Developer Platform
  • Remote Desktop Client
  • Visual Studio Code
  • Visual Studio Code – WSL Extension
  • Windows AppX Installer
  • Windows Common Log File System Driver
  • Windows Digital TV Tuner
  • Windows DirectX
  • Windows Encrypting File System (EFS)
  • Windows Event Tracing
  • Windows Fax Service
  • Windows Installer
  • Windows Kernel
  • Windows Media
  • Windows Mobile Device Management
  • Windows NTFS
  • Windows Print Spooler Components
  • Windows Remote Access Connection Manager
  • Windows Remote Desktop
  • Windows Shell
  • Windows Storage
  • Windows Storage Spaces Controller
  • Windows SymCrypt
  • Windows TCP/IP
  • Windows Update Stack

Azioni di mitigazione

In linea con le dichiarazioni del vendor, si raccomanda di procedere all’aggiornamento dei prodotti impattati attraverso l’apposita funzione di Windows Update.

Riferimenti

CVE

CVE-ID
CVE-2019-0887 CVE-2020-0655 CVE-2021-1669 CVE-2021-24084
CVE-2021-40441 CVE-2021-40452 CVE-2021-40453 CVE-2021-4098
CVE-2021-4099 CVE-2021-4100 CVE-2021-4101 CVE-2021-4102
CVE-2021-41333 CVE-2021-41360 CVE-2021-41365 CVE-2021-42293
CVE-2021-42294 CVE-2021-42295 CVE-2021-42309 CVE-2021-42310
CVE-2021-42311 CVE-2021-42312 CVE-2021-42313 CVE-2021-42314
CVE-2021-42315 CVE-2021-42320 CVE-2021-43207 CVE-2021-43214
CVE-2021-43215 CVE-2021-43216 CVE-2021-43217 CVE-2021-43219
CVE-2021-43222 CVE-2021-43223 CVE-2021-43224 CVE-2021-43225
CVE-2021-43226 CVE-2021-43227 CVE-2021-43228 CVE-2021-43229
CVE-2021-43230 CVE-2021-43231 CVE-2021-43232 CVE-2021-43233
CVE-2021-43234 CVE-2021-43235 CVE-2021-43236 CVE-2021-43237
CVE-2021-43238 CVE-2021-43239 CVE-2021-43240 CVE-2021-43242
CVE-2021-43243 CVE-2021-43244 CVE-2021-43245 CVE-2021-43246
CVE-2021-43247 CVE-2021-43248 CVE-2021-43255 CVE-2021-43256
CVE-2021-43875 CVE-2021-43877 CVE-2021-43880 CVE-2021-43882
CVE-2021-43883 CVE-2021-43888 CVE-2021-43889 CVE-2021-43890
CVE-2021-43891 CVE-2021-43892 CVE-2021-43893 CVE-2021-43896
CVE-2021-43899 CVE-2021-43905 CVE-2021-43907 CVE-2021-43908

Change log

Versione Note Data
1.1 Inserita nota per rilevato sfruttamento attivo in rete della CVE-2021-43226 07/10/2025

Il presente articolo è un prodotto originale di csirt.gov.it, riproposto qui a solo scopo di aumentarne la visibilità. Può essere visualizzato in versione originale al seguente link

Ultimo aggiornamento

7 Ottobre 2025, 11:09