All seven newly identified vulnerabilities in Microsoft products, recently highlighted by the Department of Information Security (Ministry of Information and Communications), pose significant risks, allowing attackers to execute remote code if successfully exploited.

New vulnerabilities in products and solutions from major technology companies like Microsoft are frequently exploited by attackers to infiltrate and compromise the information systems of agencies, organizations, and businesses.

From the list of June 2024 patches, which includes 49 information security vulnerabilities in Microsoft products, experts from the Department of Information Security have analyzed and issued warnings to Vietnamese agencies, organizations, and businesses.

In a recent warning to specialized IT and information security units across ministries, branches, localities, state-owned corporations, banks, and financial institutions, the Information Security Department emphasized seven high-risk vulnerabilities in Microsoft products:

- CVE-2024-30080 in Microsoft Message Queuing

- CVE-2024-30103 in Microsoft Outlook

- CVE-2024-30078 in Windows Wi-Fi Driver

- CVE-2024-30100 in Microsoft SharePoint Server

- CVE-2024-30101, CVE-2024-30102, and CVE-2024-30104 in Microsoft Office

All seven of these vulnerabilities enable remote code execution by attackers.

To safeguard their information systems and contribute to the security of Vietnam's cyberspace, the Department of Information Security advises agencies, organizations, and businesses to check, review, and identify computers running Windows that might be affected by these vulnerabilities. Prompt patching is crucial to mitigate the risk of cyber attacks on managed systems.

The Department also recommends enhancing monitoring efforts and preparing response plans for potential cyber attacks. Regular monitoring of warning channels from relevant authorities and major information security organizations is essential to detect cyber attack risks in a timely manner.

In the first five months of this year, the National Cyber Security Monitoring Center (NCSC) under the Department of Information Security recorded over 425,000 weaknesses and vulnerabilities in servers, workstations, and information systems of state agencies and organizations.

Additionally, the NCSC's remote monitoring and scanning system detected an average of more than 1,600 vulnerabilities per month across 5,000 publicly accessible systems on the Internet.

Every month, the NCSC also identifies 12 newly announced vulnerabilities with serious impacts, which can be exploited to attack the systems of agencies and organizations. These vulnerabilities are present in popular products used by many entities.

Therefore, in its periodic warnings, the Department of Information Security consistently urges units to thoroughly check and review their systems to determine whether they use products affected by the identified vulnerabilities. Taking prompt remedial measures is essential to protect information security. Continuous updates on new vulnerabilities and attack trends in cyberspace are also critical.

Van Anh