Microsoft on Monday issued out-of-band updates to address several issues caused by this month's massive, record-setting Patch Tuesday.
The emergency patches fix problems with Remote Desktop Services (RDS) that came to light last week, as well as unintended side effects for Hyper-V virtual machines and USB audio devices following the historic update last week.
September's Patch Tuesday addressed a whopping 974 unique CVEs, smashing the previous record set earlier this year; by comparison, Microsoft patched 909 CVEs in all of 2023. The release clearly illustrates how AI has supercharged vulnerability reporting and led to an alarming number of CVEs. And it may also indicate that faulty patches could become more common with increasingly large updates for software vendors.
"I think we should expect this risk to increase as patch volumes continue to grow, but the relationship is not simply that more patches automatically mean more broken systems," Ensar Seker, chief information security officer (CISO) at threat intelligence vendor SOCRadar, tells Dark Reading.
The bigger issue, Seker says, is the complexity of the modern technology landscape, with increasingly interconnected operating systems, cloud services, virtualization platforms, drivers, identity components, and legacy technologies. "Every additional dependency and supported configuration expands the testing matrix, and it becomes extremely difficult to reproduce every enterprise environment before a patch is released," he says.
Fixing September Patch Tuesday Issues
Microsoft flagged the RDS issues on Friday, noting that some organizations may experience issues after installing the Patch Tuesday update.
"In some environments, RDS might become unstable, resulting in RDP connections failing after several minutes, sign-in issues, or servers hanging at 'Please wait for the Remote Desktop Configuration,'" Microsoft said in a health status update. "Related tools, including Microsoft Management Console (MMC), RDS Licensing Diagnoser, and File Explorer might also become unresponsive."