CISA orders govt agencies to mitigate Windows and Office zero-days

CISA ordered federal agencies to mitigate remote code execution zero-days affecting Windows and Office products that were exploited by the Russian-based RomCom cybercriminal group in NATO phishing attacks.

Under the binding operational directive issued in November 2021, U.S. Federal Civilian Executive Branch Agencies are now required to secure Windows devices on their networks against attacks exploiting CVE-2023-36884.

Until patches are available, Redmond says customers using Defender for Office 365, Microsoft 365 Apps, and those who already enabled the “Block all Office applications from creating child processes” Attack Surface Reduction Rule are protected against CVE-2023-36884 phishing attacks.

CISA warns govt agencies of recently patched Barracuda zero-day.

Microsoft: Unpatched Office zero-day exploited in NATO summit attacks.

CISA orders agencies to patch iPhone bugs abused in spyware attacks.

Share this article on social media:

Subscribe to Our Newsletter!

Stay on top of cybersecurity risks, evolving threats and industry news.

This field is for validation purposes and should be left unchanged.

Recent News

Featured Services

The Latest Cybersecurity News

From major cyberattacks, newly discovered critical vulnerabilities to recommended best practices, read it here first:

BOOK A MEETING

Enter your Email Address

This field is for validation purposes and should be left unchanged.

* No free email provider (e.g: gmail.com, hotmail.com, etc.)

This site is registered on wpml.org as a development site. Switch to a production site key to remove this banner.