Microsoft Discloses 4 Zero-Days in September Update

Microsoft's September security update addresses 79 vulnerabilities, including multiple zero-day flaws—two security-bypass bugs (affecting Publisher and Windows Mark of the Web), an elevation-of-privilege in Windows Installer (CVE-2024-38014), and a high-severity RCE in Windows Update (CVE-2024-43491) that reintroduced previously mitigated issues. Several of these are confirmed to be actively exploited, and administrators are advised to prioritize patches (including servicing stack and security updates KB5043936 and KB5043083) and urgently remediate the SharePoint RCE (CVE-2024-38018) which has no known mitigations.