Patch Management for Business: Fix These High-Risk Flaws

Hackers are leaning on old, known bugs in everyday tools—Microsoft Office and Windows, Google Chrome/Chromium apps, Adobe Reader/Flash, plus Netgear and Cisco routers. Solid patch management for business closes these doors fast by updating, removing retired apps like Internet Explorer and Flash, and tracking alerts from trusted sources.

Why Unpatched Software Is Easy Pickings

Software ships with countless lines of code. Sooner or later, someone finds a gap. Developers release a fix, then new features create fresh issues. It can feel like chasing moles at the arcade.

Staying current on fixes is a core job for any managed IT provider. Skipping updates leaves your network exposed, and most of those break-ins didn’t need to happen. In early 2022, 82% of U.S. cyberattacks came from bugs that already had patches available. This isn’t just here at home around Panama City—it’s happening worldwide.

U.S. cybersecurity officials recently flagged a batch of actively exploited weaknesses. The Cybersecurity and Infrastructure Security Agency (CISA) posted a specific warning about them.

Microsoft: Retire Internet Explorer and Apply These Fixes

You’ll see “CVE” attached to each issue. CVE means Common Vulnerabilities and Exposures—the universal ID for a known flaw.

CVE-2012-4969: A hole in Internet Explorer lets an attacker run code from afar. It can be triggered by a website, so a legitimate site could be turned against you if criminals slip in this exploit. Microsoft ended Internet Explorer in June 2022; remove it anywhere it’s still installed.
CVE-2013-1331: A buffer overflow problem in Microsoft Office 2003 and Office 2011 for Mac can enable remote attacks. With this, a criminal can push malicious code onto a victim’s machine.
CVE-2012-0151: This targets Windows’ Authenticode Signature Verification. It allows “user-assisted” code execution—meaning the attacker needs the user to help, such as opening a booby-trapped email attachment.

Google Chrome and Chromium-Based Apps: Patch DoS Bugs

Chrome and software built on Google’s Chromium V8 engine are also in the crosshairs.

CVE-2016-1646 and CVE-2016-518: Both allow a remote attacker to cause denial-of-service (DoS) conditions against websites by overwhelming them with traffic.
CVE-2018-17463 and CVE-2017-5070: Two more flaws that can be used to crash sites in a similar way. Fixes exist for these as well, and users should apply them.

Adobe: Reader Risks and the Retired Flash Player

Adobe Acrobat Reader is everywhere, which makes it a popular target.

CVE-2009-4324: A PDF can carry code that runs remotely on your system. Don’t assume a PDF is safe just because it’s a PDF—be cautious with unexpected files.
CVE-2010-1297: A memory issue in Adobe Flash Player allows both remote code execution and denial-of-service attacks. Flash is retired and unsupported, so it should be removed from all computers and websites.

Network Gear: Netgear and Cisco Routers Need Attention

CVE-2017-6862 (Netgear): Found across multiple Netgear products, this flaw can let an attacker run code remotely and even skip password checks.
CVE-2019-15271 (Cisco): A buffer overflow in Cisco RV series routers can hand an attacker root-level access, giving them full control over the device.

Patch Management for Business: What To Do Now

These are just a few of the items CISA highlighted. You can review the full set of 36 additions in the Known Exploited Vulnerabilities Catalog.

Practical next steps:

Update systems and apps on a steady schedule.
Remove retired software like Internet Explorer and Flash Player.
Work with a trusted IT partner to watch for new alerts and handle updates so you’re not leaving an open door in your network.

Frequently asked questions

What does CVE mean?

CVE stands for Common Vulnerabilities and Exposures. It’s the standard ID used to track and discuss a specific security flaw.

Is Internet Explorer still supported?

No. Microsoft ended Internet Explorer in June 2022. If it’s still on any computers, uninstall it.

Are PDFs always safe to open?

No. A PDF can carry an exploit, such as the Adobe Reader issue listed as CVE-2009-4324, which allows remote code execution. Treat unexpected attachments with caution.

How can I tell if my business is affected?

Check your software and device versions against vendor advisories and CISA’s Known Exploited Vulnerabilities Catalog. If you’re unsure, have a managed IT provider audit your updates and remove unsupported apps.

Sources and further reading

— Featured Image Credit

Need help closing these gaps for your office in Bay County? Let’s talk about a plan that keeps updates on track—get in touch.