Weekly briefing

Week 31 · 29 Jul – 4 Aug 2024 UTC · assess the changes, then plan the next dates.

What to assess first

29 Jul – 4 Aug · dates to 3 Sep Check coverage

Act on3

30Jul
Exploited30 Jul 2024
VMware ESXi Authentication Bypass Vulnerability
CVE-2024-37085
Related evidence (1)
- VMSA-2024-0013:VMware ESXi and vCenter Server updates address multiple security vulnerabilities (CVE-2024-37085, CVE-2024-37086, CVE-2024-37087)
  Public source · Shared CVE CVE-2024-37085
Aug2024
Known issueAug 2024
Federated Identity Credentials now use case-sensitive matching
Identity-platform authentication changes
Related evidence (1)
- Applications must be registered in a directory
  Public source · Same source page; the statements may concern different changes
Aug2024
Known issueAug 2024
[WORKAROUND] Classic Outlook unexpectedly closes at start up on faulting module ucrtbase.dll
Classic Outlook known issues

Coming up4

13Aug
Patch TuesdayScheduled for 13 Aug 2024
Patch Tuesday, 13 August 2024
The second Tuesday of the month, when Microsoft releases security updates for Windows, Office, and servers.
13Aug
CISA KEV deadlineDue 13 Aug 2024
Microsoft Internet Explorer Use-After-Free Vulnerability
CVE-2012-4792
26Aug
CISA KEV deadlineDue 26 Aug 2024
Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability
CVE-2018-0824
3Sep
CISA KEV deadlineDue 3 Sep 2024
Microsoft Windows Kernel Privilege Escalation Vulnerability
CVE-2024-38106
Same day: CISA KEV deadline: Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability; CISA KEV deadline: Microsoft Windows Scripting Engine Memory Corruption Vulnerability; CISA KEV deadline: Microsoft Project Remote Code Execution Vulnerability; CISA KEV deadline: Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability; CISA KEV deadline: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

How this list is chosen

Changes from 29 Jul 2024 – 4 Aug 2024 UTC and dates due up to 3 Sep 2024. Dates are the source's own, or labelled as the day ChangeIntel observed a change; never inferred effective dates.

Ranked by kind: exploited vulnerabilities, then up to 3 dates, open known issues, and other notable changes, with at most one entry per feed. Service incidents are on the status board; security baseline downloads, first captures of a document, and metadata-only documentation checks are left out. This is a view of retained evidence, not a reconstruction of everything known at the time.

The briefing is selective. Browse every dated change, review upcoming dates or check the period's coverage.