Windows 11 just got some vital security updates, so don't hang around, patch now

Three major zero-day vulnerabilities are fixed, and lots of other security flaws have been addressed, including some that Microsoft considers critical.

Published
Updated
2 minutes & 18 seconds read time

Windows 11 just got a raft of security fixes in the latest round of monthly patching from Microsoft, including some crucial ones.

Security should always be a high priority when it comes to your PC (Image Credit: Pexels)

Security should always be a high priority when it comes to your PC (Image Credit: Pexels)

In fact, there are three fixes for zero-day vulnerabilities provided, meaning bugs in Windows 11 which are public knowledge. And in this case, these security flaws are being actively exploited by nefarious types - so they represent a clear potential danger to Windows 11 users.

In total, there are 77 vulnerabilities fixed by Microsoft's February patch for Windows 11 PCs, and nine are labeled as 'critical.'

Let's take a closer look at those worrying zero-day flaws, the first of which is CVE-2023-21823, which affects not just Windows 11 but also Windows 10 systems. This is a remote code execution vulnerability an attacker can use to leverage system privileges, and what's particularly concerning is that according to a recent report, it's not hard to exploit.

A security expert, Mike Walters (VP of vulnerability and threat research at Action1), told Forbes: "This vulnerability is relatively simple to exploit, utilizes local vectors, and requires low levels of access."

It also doesn't need the user to do anything (like click on something and fall for a pop-up prompt, for example) in order to work.

There's a really important thing to note on this one, and that's rather than being deployed by Windows Update, the fix for this vulnerability is being piped to Windows PCs via an update from the Microsoft Store. In other words, if you've disabled automatic updates from the store, that's something you need to be aware of.

The other zero-days are CVE-2023-23376, an elevation of privilege vulnerability (local, as opposed to a glitch that can be remotely exploited), and CVE-2023-21715 which affects Microsoft Publisher. The latter allows an attacker to evade security countermeasures that block Office macros which could be malicious, but unless you run Publisher, this isn't one to fret over.

With a total of 77 security fixes here, it's pretty obvious that this is an update you should grab - although that's fewer vulnerabilities than the previous January cumulative update addressed for Windows 11. However, there are some very important fixes this time around in terms of that trio of zero-day vulnerabilities, plus a bunch of remote code execution flaws (38 in total) some of which are marked as critical.

Sometimes with Windows patches, it pays to hold back to see if there are any problems caused by the update itself (which can certainly happen, as we've seen many times in the past from Microsoft).

With security-focused updates like this, though, packing a bunch of important cures for a lot of problems, including vulnerabilities being actively leveraged right now, it's generally a good idea to patch sooner rather than later. As ever, hit Windows Update to find the new patch (and remember that as mentioned, one of the most critical fixes is deployed via the Microsoft Store, too).

Darren has written for numerous magazines and websites in the technology world for almost 30 years, including TechRadar, PC Gamer, Eurogamer, Computeractive, and many more. He worked on his first magazine (PC Home) long before Google and most of the rest of the web existed. In his spare time, he can be found gaming, going to the gym, and writing books (his debut novel – ‘I Know What You Did Last Supper’ – was published by Hachette UK in 2013).

What's in Darren's PC?

Newsletter Subscription

Related Tags