Both critical patches address vulnerabilities that could give attackers access to client browsers and from there access to the underlying host, says Alex Horan a senior product manager at CORE Security. "Bulletins 1 and 2 target all versions of Internet Explorer on essentially all versions of Windows platforms, so it's pretty much one-hack fits all in the Windows environment for attackers," he says. "I expect a lot of interest in developing a working exploit for this vulnerability."
NAVIGATE: 12 essential Windows 8 keyboard shortcuts]
Three less urgent patches ranked important could address flaws that enable the takeover of machines accessed via the Internet Explorer vulnerabilities, he says. "Bulletins 7, 8 and 9 seem to target the same underlying systems as Bulletins 1 and 2, which means hackers could phish users and then leverage 7, 8 and 9 to get system level control of their machines. That is essentially a worst case scenario and knockout punch for security personnel," Horan says.
Another security expert Paul Henry, a security and forensic analyst for Lumension, says the two critical Internet Explorer problems could be linked to Java. "It's possible that this is related to the recent and ongoing Java issues," he says. "Microsoft has a very close relationship with Oracle, so it wouldn't surprise me if these bulletins include Java patches."
Regardless, they put unpatched machines in danger of falling to remote code execution exploits, Microsoft says, and may require restarting affected machines, something that will make installing the patches a longer exercise.
There are 12 patches in all this month, an uptick from the past few months, and they affect a wide range of Windows platforms from Windows XP to Windows RT, the new Windows 8 tablet operating system that runs on ARM processors. "It's never a good sign when your current code base is impacted," Henry says. This month's 12 patches is the highest number since June 2011 when there were 16.