Microsoft Update Health Tools Vulnerability Enables Remote Code Execution

First seen 2 Dec 2025, 18:33 UTC • Gbhackers

•24

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A critical remote code execution vulnerability has been identified in Microsoft’s Update Health Tools (KB4023057), which is widely used to facilitate security updates via Intune. The flaw allows attackers to execute arbitrary code by exploiting connections to compromised Azure Blob storage accounts. This vulnerability affects systems utilizing this Windows component.

How this analysis works

Attack Flow

7 entities, 12 inferred relationships (STIX 2.1).

Technique (1)

Zero-day Exploit

Affected Platform (3)

Azure Blob Storage
Microsoft Update Health Tools
Windows

Vulnerability (3)

Kb4023057
Microsoft Update Health Tools Vulnerability
Update Health Tools Configuration Vulnerability

Relationships

Kb4023057 targets Azure Blob Storage
Kb4023057 targets Microsoft Update Health Tools
Kb4023057 targets Windows
Microsoft Update Health Tools Vulnerability targets Azure Blob Storage
Microsoft Update Health Tools Vulnerability targets Microsoft Update Health Tools
Microsoft Update Health Tools Vulnerability targets Windows
Update Health Tools Configuration Vulnerability targets Azure Blob Storage
Update Health Tools Configuration Vulnerability targets Microsoft Update Health Tools
Update Health Tools Configuration Vulnerability targets Windows
Zero-day Exploit targets Azure Blob Storage
Zero-day Exploit targets Microsoft Update Health Tools
Zero-day Exploit targets Windows

Continue Reading

Critical RCE Vulnerability in Microsoft Update Health Tools Exposed

Microsoft Update Health Tools Vulnerability Enables Remote Code Execution

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading