Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Vulnerability Management

06:25 PM

Patch-a-Palooza: More Than 560 Flaws Fixed in a Single Day

Software vendors keep pushing patches to the same Tuesday once a month, or once a quarter, and the result can be overwhelming. Six enterprise software makers issued patches for 567 issues in April.

Information technology groups have their work cut out for them this month. 

On April 14, six makers of popular enterprise software — Microsoft, Oracle, SAP, Intel, Adobe, and VMware — issued patches for at least 567 software vulnerabilities. Oracle's Critical Patch Update for the month, which rolls up fixes into a single massive patch for each product, accounted for more than 70% of the patch load, addressing 405 new security vulnerabilities, according to the company. An analysis of Microsoft's April security bulletin found that the company closed 113 security vulnerabilities, while SAP, Intel, Adobe, and VMware accounted for another 49 issues.

Overall, the crowding of software fixes has turned the second Tuesday of the month — a day on which Microsoft has traditionally released patches for many years — into a deluge of work for IT groups, says Jake Kouns, CEO and co-founder of Risk Based Security, a vulnerability information and management firm.

"Patch Tuesday is all about making software updates more organized so that companies can assign resources because they know when [the patches] come out," he says. "With more and more companies piggybacking on that, it becomes a challenge. How many patches can you handle in one day?"

The massive patch load comes as companies continue to adjust to the vast majority of their employees working from home, a fact that means patching could cause significant headaches, especially if companies have not prepared a capability to efficiently push patches to workers' machines. 

"Given the shift to remote work for many organizations in combination with the current patch load from Oracle's update earlier this week and what looks like a backlog of patching, this looks like a busy month for many security teams," says Jonathan Cran, head of research at vulnerability management firm Kenna Security.

Oracle issued Critical Patch Updates (CPUs) for 26 different products, including issuing fixes for 74 vulnerabilities in its E-Business Suite and 56 vulnerabilities in its Fusion Middleware.  

Microsoft closed 113 security holes in Windows, Microsoft Office, the Internet Explorer and Edge browsers, and other apps and tools. Nineteen of the vulnerabilities were rated Critical, 96 Important, five Moderate, and two Low, with nine issues rated differently, depending on the platform. One flaw, CVE 2020-0796, is a remote code execution vulnerability and is currently being used in active attacks, according to Kenna Security.

SAP patched 33 flaws, five of which were given a Common Vulnerability Scoring System rating of 9 or higher. Finally, Intel closed 9 issues in different firmware and software components, Adobe shuttered five security weaknesses, and VMware fixed two issues.

For companies that have moved to remote patch management, the workload should be manageable. Yet many companies were taken by surprise by the need to move employees to remote working, and the sheer number of fixes that need to be deployed this month could cause problems, says AJ Singh, co-founder and vice president of product at NinjaRMM, a remote monitoring and management service. 

"It is definitely a bigger hassle," he says. "And if there is a bad patch that causes issues, companies may have to put boots on the ground to actually fix the devices."

Even without the need to work during a pandemic, the move of many companies to release patches on the same day as Microsoft's original Patch Tuesday may be hurting customers more than helping them. 

Overall, the number of vulnerabilities released annually has more than doubled in the past three years. While that has largely been driven by the fact that more vulnerability reports are issued for a wider variety of products, the number of vulnerabilities released on peak days has also increased, according to Risk Based Security, which calls this perfect storm a Fujiwhara Event.

"I think it does make it more difficult," says Risk Based Security's Kouns. "Most companies — those that are dealing with remote patching before — won't have a problem. But for companies who when you ask, 'why did you adopt cloud?' and they answer, 'because of COVID' — they are going to have problems."

Related Content

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19. 


Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-24
Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php.
PUBLISHED: 2021-06-24
CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php.
PUBLISHED: 2021-06-24
In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery). The vulnerable code is in file /crmeb/app/admin/controller/store/CopyTaobao.php.
PUBLISHED: 2021-06-24
All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.
PUBLISHED: 2021-06-24
An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases.