Transcript
I'm also an engineer at Avanti, just like Maxime. So, we will be able to start this patch Tuesday of June. So, here is the usual agenda that will be carried out. We will go through a overview of the patch Tuesday of June, talk about the recent news, and then we will present the bulletins and patches of this month. We will finish with the famous section between patch Tuesday. So, let's say it right away, we are in the era of the patch apocalypse. Today, currently, in more and more vulnerabilities, the records are falling one after the other in this month of June. So, on June 3, for example, Google published a Chrome update correcting 429 vulnerabilities in a single update. Same thing from Microsoft's point of view, on Tuesday. For this patch Tuesday, Microsoft corrected 198 vulnerabilities. This is the historical record, knowing that the previous record was dated October 2025 with 175 CVEs. So, we are clearly in a tendency to increase the number of vulnerabilities and all publishers are concerned, and the rate of publication is accelerating. And why this explosion? It is the new generation of LLM tools, specialized in security, which will help discover and exploit vulnerabilities in applications faster than ever. And so, the game is accelerating on both sides, both defenders and attackers. This month of June includes Adobe updates, three critical updates, Google, a critical, five critical, one important. In addition, we also have more than 80 security updates for third-party applications, enriching hundreds of additional CVEs. For the overview of this patch Tuesday of June, I'll hand it over to André. Thank you, Maxime. I'll go to the next one. There are several exploits, Bleeping Computer, Downgrading, etc., Google Chrome, and I'll share my screen if I find the button. Where is the button? Ah, there. Ah. That was the other button. Entire screen. Share. This is the link on the support, on the PowerPoint. Microsoft warns about a failure in the defender. So, zero-deployed attacks. And if we want, we can translate it very quickly in French. That's the advantage of Google. So, there is an update this month, which dates from May already, but which is starting to be exploited on the defender. And it's quite important too, because if the attackers can use the defender in this CVE, the attackers can use the defender for a denial-of-service attack and then have privileges on the system. So, what happened here, to obtain system privileges, etc. So, it's quite important anyway, especially for the defender, it's quite important because they scan. You have to make sure if the defender can always update, because the first thing the attackers do, they stop the update of the defender, precisely to not recover the patch for the defender itself. So, be careful, if your defender can no longer update, maybe you are already introduced with an attacker. The second, the 0D, so Spark Backlash, in fact, a researcher had published the 0D of Microsoft and Microsoft wanted to attack it in court, but the community of researchers on DeFi hit Microsoft a little and said, no, you can't do it, you must above all not attack the researchers, but above all make sure you remove patches or repair the code that has no vulnerability. So, that's quite interesting to read, it's quite long, but it's interesting because it still shows that Microsoft says, yes, we know that there is a vulnerability, but we wanted to have it silent to be able to make a patch. Now we need to speed up this process, but for me, it's normal that if we find a bug, we first inform the editor and if the editor doesn't move, we publish the bug and then the editor has to react. On Chrome, there are also a lot of exploits and patches, so this time, with a fairly high CVSS score, we also saw on Chrome and Firefox and other browsers that the patches come out almost all the time, so they no longer wait for the 2D patch, it's almost a continuous patch and we will have to enter the system more and more that we also have to patch all our systems continuously, because with artificial intelligence, the hacker will use AI to be able to find bugs and there are some bugs that he finds that are very old, almost 20 years old, and he will also use natural intelligence to create exploits to hack systems. Don't worry, editors also use artificial intelligence like Ivanti and other editors, precisely to test the logic in the same way and we try to be a little more reactive and proactive so that we detect a bug before the hacker detects it and we can fix it before. Knowing that patches and vulnerabilities come out faster, they are detected faster too, we have to patch faster too. Now the average between a published vulnerability and an exploit is about 5 days. So if there is a published vulnerability, 5 days later, some hackers already have an exploit to optimize their attack. So 5 days is very short. I know companies that have a patching cycle of 2 weeks, 3 weeks, 1 month, on certain things and that's enough. So for that, you need to know your package, you need to know what are the installed logic and you also need to prioritize the patches. So at Ivanti, we use the CVSS score, so the CVE score, but also a dynamic score called VRR which will be calculated on average, so let me show you, so the score is calculated not only by the CVSS, the CVE, but also if the vulnerability was exploited directly. Do we see a lot of exploits, a lot of things on the darknet, etc. Does OWASP show in the OWASP list, etc. Both together, all these criteria together, will give a score that is dynamic. So CVSS can be classified as low, but with all the rest, they can be classified as very high. And we will go a little further, we will look, ok, maybe it's a very high score, but maybe this logic is used on one or two machines. And if it's used for a lot more machines, in this case we have a maximum VRR of 10. So this is a prioritization of patching that you need to think about, because every patch, patch invisible, which is not very vulnerable, we patch it, but it's not the urgency. The urgency is the vulnerability that is actively exploited by the hackers, because it's there that you have the greatest risk. So when we look at it, there is a security update guide from Microsoft, so if you want, you can look in detail at the CVE. There is another site that is very interesting, it's at the level of the patch Appaloosa. So this is only for the Microsoft patch, so it's a Microsoft site, it's Microsoft that manages it, and there we can see on the CVE of Microsoft what came out. So there are 700 CVEs already published this year, not just this time, but this year. And if we look at the year 2025, most of them were 1,000-1,100. So we really see an explosion of CVEs since the beginning of this year, and it's not going to end at the end, so we think it's going to be much higher here, because artificial intelligence does that, and that's only for the Microsoft patch. There are other sites on French, in France, that you can also see what is the trend of this graphic on all patches, so not just Microsoft, but all patches for secret editors. And we see the same style of graphics. In our presentation, there is also a slide that Chris Cuttle, our colleague at the US, did himself, because he used artificial intelligence to create this slide to see on some editors, not all, but some, what are the CVEs patched since this year, and he still shows the same style of graphics on the slide. OK, I'll stop now, I'll go back to the slide. How do I start it? We were here, so it's this slide by Chris Cuttle, so he created a patch release tracker using artificial intelligence, and here we see the same style of graphics. Here he used only a few editors, so Firefox, Chrome, Acrobat, Windows, Edge, but not all, but we see everywhere an explosion of CVEs. OK. Your turn, Maxime. It's my turn. Thank you, André. So, let's continue after this little news with the three vulnerabilities that Microsoft publicly revealed during this June 2nd patch, three vulnerabilities publicly revealed. Microsoft corrected them in the OS update on Tuesday, and of course, this update of the Microsoft OS is our number one priority this month. Once again. 30 vulnerabilities as well this month, which is clearly a rise in the number of corrected CVEs on Microsoft products as I said in the introduction. So, for the first vulnerability that we see here, publicly disclosed, it's a vulnerability on the Windows Collaborative Translation Framework. So, the operating code of this vulnerability has not been made public. That's good news. But be careful, because even without a published code, the disclosure of a vulnerability can contain enough information for hackers to understand and look for us. This is especially the case of people who have become vulnerable, for example, in this month of June versus the month before May. By comparing the two, they will identify the areas that have been modified by Microsoft and focus on those areas to try to find the vulnerability. So, whether or not the operating code of the vulnerability is published or not, it only saves a few hours or a few days The risk is therefore high if this vulnerability is exploited. An attacker can obtain system-level privileges, in other words, total control over the machine. We note a CVSS score of 7.8. This is also important. The second publicly disclosed vulnerability is the CVE-2026-49-160. It's a service denial flaw in HTTP.1.6. It's the component of the Windows core that manages the HTTP protocol. It is used by 2IS and many Windows applications. What is worrying with this vulnerability is that it is exploitable remotely via the network without any required privileges and without user interaction. An unauthenticated attacker can send HTTP traffic without any availability of the service denial. We have a CVSS score of 7.5 here. This vulnerability was discovered by an AI tool. This is another example. It's a strong signal. As we said from the beginning, the AI is now used by researchers and cyber-attackers to find flaws. This is an example No code of exploitation has been published yet. But a significant amount of technical information has been disclosed. The risk is high, especially for any organization using web services. The third publicly disclosed vulnerability is patched by Microsoft this month. It concerns a bitlocker bypass. The disk encryption integrated in Windows. This one, unlike the other two vulnerabilities I mentioned has a proof-of-concept code that is public. This requires significant risk. We have access to proof of how to use this vulnerability. This vulnerability allows an attacker with physical access to bypass BitLocker and access the encrypted data on the disk. No need for credentials or user interaction to do it. It's a CVSS score of 6.8 This is exactly the scenario you can imagine. No need for credentials or user interaction. It's a nightmare scenario for any company. If you have a laptop that is lost, stolen, or simply left unguarded, the attacker takes the device, isolates it from the network, and starts it. Thanks to this vulnerability, it can bypass BitLocker and access the protection mechanism of the TPM that releases the encryption key. For the three disclosed vulnerabilities that have been corrected in the OS update of Windows this month, the priority is to update the browsers, Chrome and Edge, and your OS, the priority of this month. I'll leave it to André. Regarding Linux, I don't know if you followed, but there is a bug in the Linux kernel that has existed for a long time and affects almost the entire industry. It is highly recommended to update the kernel. There are already patches available for almost the entire industry, but you have to update the kernel or disable a certain kernel plugin. There are articles on the Internet that talk about this. Knowing that it also exists on Linux, so Linux is not all clean either. There is also CVE on Linux. Here, for example, there is a problem on the Samba SIP system. If someone uses a script, he can use code in the script to access the system or block the printer or block the system, etc. This is information that we have from our partner called TuxCare. We have a partnership with TuxCare. They provide us all the information on Linux, etc. Yes, I have to click on next. Another vulnerability on Nginx Rift, an open source. If you use this on your system, if you have the library installed, version 1.30, the CVS score is 8.2, still quite high, and you have to patch it because the access is through the ASLR, which allows remote code execution, and if you execute remote code on a system, you have to do everything. Quite interesting. There is also mitigation, so how do you fix it? Quite simply, update it. 1.30 to 1.31. Normally, on Linux, if you do an update and update and upgrade, automatically, they have to recover it if you have the right repository configured. And the other on Linux is the CIFS switch, which is used a lot in most Linux districts, because CIFS is the file system, and it is also a kernel module, so if you don't need the CIFS utility, it is disable or block the kernel module. Here, it is the same, you have to block the kernel module, and you have a link on the support that gives you exactly what to do, etc. on this file. But Linux, there are some, but there are still some. We will see that later in the bulletin too. There are bulletins for Windows, but also for Linux. Thank you, André. We continue, we now move on to security updates for Ivanti. As you know, Ivanti now follows a monthly rhythm, like the Tuesday patch, to publish patches and correct some vulnerabilities. This month, for those of you who use Ivanti Endpoint Mobile Manager, or also Ivanti Sentry, the gateway associated with our Modern Device Management products, updates have been published for these two products. Each update corrects two vulnerabilities. Nothing is actively exploited at this stage, but these are important security updates anyway, so take into account if you use these solutions, Ivanti Endpoint Manager Mobile and Ivanti Sentry, which is the gateway associated with our Modern Device Management solutions. Let's move on to the end of support for Windows 11. No new notifications this month. We can see here editions that are approaching their end-of-support date, in terms of the closest end-of-support date. October 13, 2026, with the 24H2. November 10, November 10, 2026 for Windows 11 Enterprise and Education with the 23H2. But nothing very close for now. On another subject, we also discussed a few months ago the extended support for Windows Server 2016, the extended support for this version of Windows. Good news, everything is ready for those of you who are preparing and have the ESU for Windows Server 2016. You can now contact us to plan and maybe budget the activation of ESU content in your Ivanti environment. In short, if you are a client of Ivanti Neurons Patch or EPM Patch or Security Controls, and you plan to continue running Server 2016 beyond its end-of-support date, while subscribing to the Microsoft ESU coverage, you will also be able to benefit from the ESU update via the Ivanti products. You need to contact Ivanti to activate the budget. We can see here the last line, Windows Server 2016, which has a mainstream support end in 2022, and the ESU which will be released in 2027. You don't have to worry about it. Let's continue. There is also a tool update here. On the service-in-stack side, a single update was published in June 2026. It only concerns Windows 10. It's the only service-in-stack update of the month. And we end this part of the news with a reminder. On the Ivanti Hub site, there are many announcements. Please refer to the different categories that correspond to the products you have at Ivanti, for example, or to the OS you are interested in to stay up to date and have content notifications added to the Ivanti community site. Let's move on to the bulletins. Just a remark about the Windows 10 patch, because Windows 10 is officially no longer supported, but despite that, Microsoft still released a patch for Windows 10. It's quite interesting. It means there is still a need to patch your Windows 10 if you still have it. For the bulletins, there is one on Google Chrome marked High. Why is it marked High? Because the CVE 2611645 is exploited. It means it's a file that is actively used by the hacker. But this bulletin contains 74 vulnerabilities. If you click on the link, you have a list of all the 74 vulnerabilities that Google patches in this case. Also, it needs a restart, a reboot, especially the application. If you apply the patch, the hacker will close the application or you have a patch after the patch application that will kill the touch probe to restart it. Adobe also released a few patches. InDesign is critical. If you have InDesign in your portfolio, we advise you to update it. It is critical, but it is not yet known to be exploited in the wild. It is still exploited critically because the file was published. You just need to find a way to exploit this file and it will compress your system. The same for Adobe InCopy. It is also critical. All the products affected are InCopy 21.3 and 20.5.3. There is also a link on the information on this file. The impact is Code Execution. They can execute anything. If you apply the patch, you need to restart the application. Excuse me. Acrobat Reader is probably one of the most used applications by Adobe. Acrobat Reader is free and used by a lot of people. Not only in business, but also in private. Make sure you update Adobe Reader. Maxim Shevet is critical. It is not yet actively used. But the update has 20 vulnerabilities. Out of 20, 15 are classified as critical and 5 are important. It is an important update for Acrobat Reader. It also requires a restart. Windows 11 There is also a Windows 11 update. 2023, H2, 2024, 2025, 2026, H1. And even server 2025 for H Chromium. Since there are a lot of patches in Chrome, it is logical in H Chromium that you have direct patches with 116 vulnerabilities that repair. And there are 3 that are actively used. It is important that you patch anyway. ADR publicly disclosed means that they are known. For now, they are not actively used but since they are known, it is just a matter of time for them to be used. So, there is a problem that we have seen that dates from what we have already seen before, but Windows Update Services does not go back to synchronization details. It is a reporting error. It is not a functional error. If you apply the patch, you may have a reporting error on WSUS, but know that the patch is still applied on your system. I continue with the LTSB branch of Windows 10. LTSB are the editions that continue to receive updates of the OSU program of Windows 10. Of course, if you also have a version covered by the OSU of Windows 10, you will also receive these updates. This patch covers Windows 10 LTSB, Server 2016, Server 2019 and Server 2022. We have a maximum severity that is critical. In total, we have 104 vulnerabilities corrected in these updates and we still have the same three vulnerabilities publicly disclosed, which I talked about at the beginning of the session. Impact, large spectrum, code execution at a distance, service identity, privilege elevation, etc. Of course, this requires a restart once the update is installed. However, there is a persistent known problem linked to BitLocker that seems to be in the head before deploying. It's on Windows Server 2022. According to Microsoft, some devices with a configuration of non-recommended BitLocker policy group can be invited to grab their BitLocker recovery key at the first restart after the installation of the update. We see the same problem on Windows 10 2022 H2, LTSC 2021 and LTSC 2021 too. The same BitLocker problem can occur. If you have BitLocker posts with BitLocker enabled, check the GPO configurations before deploying. Otherwise, you risk having your users blocked on the BitLocker recovery screen at the start. Take this into account. Outside of Windows operating systems, there is no title of the slide. I will tell you in parallel. There is a display problem here. This is the security update for Microsoft Office. Microsoft has clearly highlighted 26 vulnerabilities corrected in the standard Office suite. This is an unusually high volume. The interesting point is that Office 2016 continues to be updated even though it is officially end-of-life since October. Microsoft continues to publish updates. This is what is noted here. Why? Simply because a lot of users continue to use Office 2016 as a standalone version. So, for 26 vulnerabilities for this Office update, I will also tell you the title of this one. Always in Office, it is Security Updates for Microsoft 365 Apps, online and subscription versions. We are talking here about Microsoft 365 Apps, LTSC 2021 and 2024 versions, and also Office 2019. Office 2019 which is also end-of-life but also receives updates. This update corrects 32 vulnerabilities. It is also critically ranked, so a lot of CVEs are quite critical themselves, individually. The good news is that no vulnerability is exploited or disclosed publicly on Office. No known problem reported, a simple restart of the application is enough. You still have to install it well, but there is no known failure and no vulnerabilities are disclosed. Let's continue. Still no title. It is Security Updates for SharePoint Server. The treatments linked to the SharePoint Server Office. This month, it is 30 vulnerabilities corrected. Always critically ranked. The three versions supported by SharePoint are SharePoint Substitution Edition, SharePoint Enterprise 2016 and SharePoint Server 2019. And finally, we have a rather rare update. It is an update for Action Server this month. The latest security update for Action Server dates back to August. It's been several months since we had a correction for Action Server. This time, it is 7 vulnerabilities corrected. The only version actively supported today is the Exchange Server Subscription Edition. But several old versions are still covered by the OSU program and have also received updates. If you run older versions of Action Server, it will monitor and update by the OSU program. That's it for the release list of this Patch Tuesday. We will continue with our last section, which is Between Patch Tuesday. What happened between the May and June Patch Tuesday? Because all publishers do not follow the pace of Microsoft to publish vulnerabilities and associated corrections once a month. There is a lot of activity this month, as André said. We are in an era where there will be more and more vulnerabilities discovered, and we hope to patch these vulnerabilities. For this Between Patch Tuesday part, we make three groups of updates. We mainly list security updates with CVEs. Then you have a list of security updates but without associated CVEs. Then there are updates that are not security, such as bugfix or other updates functionality. If we go into detail, we have Google Chrome which published two updates, one of 16 vulnerabilities and the other 75. We also have Docker for Windows. We also have a lot of vulnerabilities. Version 151 had 31 vulnerabilities. ESR 20 vulnerabilities. We have found FauxdeSite, FDF, Golang, NTD, JD. They have a vulnerability. We do not re-note++ which had a bit of a problem in terms of updates. Recently they changed their update system so there were two versions of their release correcting all three vulnerabilities. We find at Mozilla the Thunderbird with 29 vulnerabilities to have 151 to correct. Then we also go to Apple. I'll let André finish on the Apple part. On Apple, we find more or less the same patch style as on Windows. There are some products more Mac-oriented than Windows, like PyCharm Professional, etc. But in terms of updates, it's more or less the same style as Benetton with the same update style. Firefox is the same. Firefox and Mozilla have released a lot of updates and they are starting to follow the same technology, the same strategy as Google. That means they are almost releasing continuous patches. As soon as there is a vulnerability detected that is ready to be patched, it is published and you can retrieve it. That's why between the two patches, Tuesday, you also find patches of these applications continuously. So, Firefox, ESR, Edge, Teams, PyCharm, these are all vulnerabilities and patches between the two Tuesday patches. If you don't always follow the Tuesday patch, you have to roll out patches every month, knowing that for a month you can be vulnerable to products like this one. So, the Tuesday patch is good for Microsoft because Microsoft only releases monthly, but in the future it may change as well. For Thunderbird, there was also an update of Notepad++. Notepad++ changed the way they updated their update technique and there was also a problem that some updates were not hosted on the right site. So, there were some updates that were hosted on the wrong site, that were not correct, so they fixed that and because of that, I don't know if you saw, but our patching product couldn't really patch Notepad++ because we couldn't download the updates. So, that's normally fixed now. If that happens to you, you can always do a sideload, download the patch yourself and include it in our patch solution to distribute it. Are there any questions? I didn't check if there are any questions. No, there are no questions. There are no questions. So, if you have any questions, don't hesitate, otherwise you can always ask us if you have any questions about patching. Knowing that, little by little, our product, especially on our cloud platform, we are going to change the patching strategy to have what we call compliance, so we are going to say that this product and this post are critical, they must be patched with compliance and as soon as a patch comes out, we are going to patch it. Of course, it won't work without a risk, because some patches can have a problem in terms of production, but this risk is less important than a hacker putting a ransomware on your device, for example. So, security is always a balance between risk and vulnerability and operability. There is no zero risk, but we are going to try to close the gap between the problem and the solution as soon as possible. As I said at the beginning of this patch Tuesday, on average, it's five days now. So, think about your strategy. Patching once a month is not really enough. If there are no other questions, Maxime, do you have anything else to add? No, very good. The last word was perfect, André. Thank you all. The last slide is not modified. Patch Tuesday, you can also find it on YouTube in English, the original. We copied it a little to another source because they talk a lot, to not necessarily say a lot of things. We try to be a little more effective on that. But Chris and Todd, they all do Patch Tuesday in the US. If you want, you can also look at the English version. And with that, I wish you a good end of the day. Good day to you all. Goodbye. Thank you.
