CyberzSOC

On April 9, 2024, Microsoft addressed 150 vulnerabilities in its April 2024 Patch Tuesday update [1], including 67 remote code execution (RCE) vulnerabilities and 2 zero-days exploited in It is recommended applying updates as soon as possible on affected products. The first zero-day vulnerability, tracked as CVE-2024-26234, is described as a proxy driver spoofing vulnerability and was issued to track a malicious driver signed using a valid Microsoft Hardware Publisher Certificate [2]. Microsoft has added the relevant certificates to its revocation list as part of the usual Patch Tuesday cycle. The second vulnerability, tracked as CVE-2024-29988, is described as a SmartScreen prompt security feature bypass vulnerability caused by a protection mechanism failure weakness [2]. This vulnerability is related to CVE-2024-21412 , which was discovered by ZDI threat researchers and first addressed in February. The first patch did not completely resolve the vulnerability.