← SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
SANS Stormcast Wednesday, March 11th, 2026: Windows, Fortinet, Adobe, and Zoom Patches
00:06:10
SANS Stormcast Wednesday, March 11th, 2026: Windows, Fortinet, Adobe, and Zoom Patches
Loading summary
Transcript1 lines
- [00:05]
A
Hello and welcome to the Wednesday, March 11, 2026 edition of the SANS Internet Storm Center's Stormcast. My name is Johannes Ulrich recording today from Jacksonville, Florida and this episode is brought to you by the Sans Edu credit certificate program in cloud security. Well, and today of course, Microsoft's patch Tuesday leaked the news. Microsoft did release updates fix 93 vulnerabilities, 9 vulnerabilities in chromium that affect Microsoft Edge. Now among the vulnerabilities we had eight critical vulnerabilities and two that were disclosed prior to today. But this time we had no vulnerability that was actually already exploited. Now when it comes to disclosed vulnerabilities, the first one is a denial of service vulnerability in. Net. Microsoft considers exploitation unlikely and denial of service or vulnerabilities, while this one doesn't require authentication, it could be exploited across the network. It's still not usually sort of at the top of the priority. The second one is probably even a little bit more interesting. It's a privilege escalation in SQL Server. Now you need to be authenticated in this case to then escalate privileges to sysadmin. But the scenario that I envision here is where for example, you have a web application or something like this that has access to a SQL Server using a lower privileged account. Maybe there's a chance here to exploit that, but that's not really clear from the advisory. The advisory is usually is fairly sparse then among the critical vulnerabilities. Well, there are a couple of them that are included in the list here, but they're actually in Microsoft's cloud products and that's, you know, they have started doing that in the last few months sort of for transparency where they tell you what they patched in the cloud. So those are nothing where you have to do anything. Like there's a Microsoft payment orchestrator. There's also Microsoft ACI confidential containers. These four vulnerabilities between those two products are all cloud based. So nothing that you need to do. Probably sort of most interesting from exploit point of view are a number of Excel and Office remote code execution vulnerabilities. That's definitely stuff that you need to patch. Also interesting that one of the cradle vulnerabilities was reported by Expo, which is a famous AI company that basically finds vulnerability. That made quite a bit of news lately. So that's it for Microsoft. But Microsoft wasn't alone today when it comes to patches. And then continuing with patches, we got patches from Fortinet for a number of their products. I'll focus here on the high and the one critical vulnerability they're about talking two high vulnerabilities in Fortinet's ranking they're both buffer overflows, one affecting the 40 switch ax fixed and that's an LLDP issue. So that's something where you need sort of network adjacent traffic in order to exploit that. The second one affects 40 manager and here in particular the FGT updates service. So this is possibly a little bit more remote exploitable. There's one critical vulnerability that was patched yesterday and that vulnerability is really just the OpenSSL patch that was released a week or so ago. I think I mentioned the vulnerability here. It's also a potential code execution vulnerability in OpenSL. A lot of dependencies on whether or not that's exploitable. But Fortinet did rate it as critical and a couple different products are affected by this vulnerability. And of course we got Adobe 80 vulnerabilities across eight different products. And well if you have been listening to this podcast for a while, of course there are always a couple Adobe products I'm particularly interested in Adobe Commerce. Here is in the list again with some remote code execution vulnerabilities that are exploitable via cross site scripting. And then we also have Adobe Acrobat Reader which suffers from three vulnerabilities. Two of them are critical and do allow remote code execution. So Alexa is usually the products that I worry about because Commerce fairly popular and sort of often exposed to the public and of course Acrobat Reader probably the most popular product here from Adobe today. And Zoom or recent updates. Zoom usually not so much participant of patch Tuesday but we got an update for Zoom Workplace for Windows fixing one critical vulnerability, CVSS score of 9.6. They describe it as an external control of file name or path and apparently if you're using the mail feature of Zoom Workplace that could be exploited. I assume it's some kind of attachment or such where as you're saving it, the attacker controls where the particular file is being saved to and that of course can always then lead to remote code execution if you're able to direct the file into some folder or such where it's then being executed well. And that's it for today. One patch sort of I didn't cover was SAP, had a couple of them. So if you're running that, double check if there's anything in the patch but it's one of the more complex areas and thanks for listening. Thanks for anybody who is leaving good comments or subscribing or liking and as always talk to you again tomorrow. Bye.