Microsoft Intune Endpoint Protection vulnerabilities

2 CVEs affecting Microsoft Intune Endpoint Protection, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-0986, published 2018-04-04.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-8540: Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability, published 2017-05-26. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 71.9% chance of exploitation in the next 30 days. The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and…
• CVE-2018-0986, published 2018-04-04. High severity, CVSS 8.8. EPSS: 63.3% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption, aka "Microsoft Malware…