Microsoft's April 2020 Patch Tuesday includes 113 CVEs, including a patch for two zero-day flaws (CVE-2020-0938 and CVE-2020-1020) in Adobe Type Manager Library.

Microsoft addressed 113 CVEs in the April 2020 Patch Tuesday release, marking the second month in a row that Microsoft has patched over 100 CVEs; the March 2020 Patch Tuesday contained fixes for 115 CVEs. Of the 113 CVEs, 19 were rated as critical. Two vulnerabilities were publicly disclosed prior to Patch Tuesday. Initially, we reported that four vulnerabilities were exploited in the wild. However, Microsoft updated the exploit status for one of those vulnerabilities, decreasing the count to three.

This update contains patches for 39 remote code execution flaws as well as 38 elevation of privilege vulnerabilities, including fixes for Microsoft Windows, Microsoft Edge, Microsoft Office, Internet Explorer, ChakraCore, Windows Defender, Visual Studio, Microsoft Office Services and Web Apps and Microsoft Dynamics.

A list of all the plugins released for Tenable’s April 2020 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

For more in-depth analysis, please see our blog on this month's Patch Tuesday.