Rick Cole

**Name of the Vulnerable Software and Affected Versions** Microsoft Office Publisher (affected versions not specified) **Description** The issue is a security feature bypass vulnerability in Microsoft Office Publisher. It has been found exploited in the wild, affecting Microsoft products. There is no information provided about the estimated number of potentially affected devices worldwide or specific technical details about exploitation, such as API endpoints, vulnerable parameters, or function names. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft App Installer versions prior to 1.21.3421.0 **Description** The issue is related to a spoofing vulnerability in the AppX installer that affects Microsoft Windows. This vulnerability can be exploited by attackers using specially crafted packages that include malware, such as Emotet/Trickbot/Bazaloader. An attacker could craft a malicious attachment to be used in phishing campaigns, and users with administrative user rights are more impacted than those with fewer user rights. Microsoft has seen an increase in activity from threat actors leveraging social engineering and phishing techniques to target Windows OS users and utilizing the ms-appinstaller URI scheme. The estimated number of potentially affected devices worldwide is not specified. **Recommendations** For versions prior to 1.21.3421.0, update the App Installer to build 1.21.3421.0 or greater. As a temporary workaround, consider disabling the ms-appinstaller protocol handler to minimize the risk of exploitation. Restrict access to the ms-appinstaller URI scheme to protect the system from this vulnerability. Avoid using the ms-appinstaller protocol handler until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows (affected versions not specified) **Description** Remote code execution is possible in MSHTML, the browser rendering engine used by Microsoft Internet Explorer and hosted within Microsoft Office documents. The issue stems from incorrect code generation management. An attacker can exploit this by crafting a malicious ActiveX control and embedding it into a Microsoft Office document. If a user is convinced to open the document, the attacker can execute arbitrary code on the system. Users with administrative rights are more severely impacted than those with restricted user rights. Real-world exploitation has been observed in targeted attacks by state-sponsored groups, such as APT 35, and has been used to deploy the MerkSpy spyware to monitor activities and capture sensitive information. **Recommendations** Install the security updates released on September 14, 2021, immediately. For enterprise customers managing updates, deploy Microsoft Defender detection build 1.349.22.0 or newer. Keep antimalware products up to date to ensure detection and protection.