While we’ve already focused on how new features in Apple’s latest operating system upgrades can help you get work done on an iPhone and on a Mac, under-the-hood enhancements for enterprise IT also made the cut. Here’s a rundown on what was introduced.

Apple’s changes for enterprise and education deployments lean toward declarative device management (DDM) as the company continues to navigate away from MDM profiles. They also include security tweaks to manage newly-introduced features such as iPhone Mirroring on Mac. 

The latter is interesting in its own right, as it means IT can prevent managed iPhones from being mirrored on any Mac, and any Mac can also be prevented from mirroring any iPhone. That makes sense, as it puts a barrier in place against abuse of that feature.

On the good ship DDM

Apple has flagged its move toward Declarative Device Management (DDM) since it first introduced support for this way of managing devices in 2021. This was originally only available to user-enrolled iOS devices, then Macs joined in. It is now supported across all the company’s products, including the Apple Watch and Apple TV. In 2022, Apple told us explicitly at WWDC that DDM will eventually supersede its own older MDM framework.

The beauty of DDM is that it allows IT to specify a desired state for devices. That means devices that do not occupy that “state” won’t get access, and the device doesn’t require continuous prompts from an MDM server.

Admins recognize that this makes for faster onboarding, better update management, improved device monitoring, better security and reduced network bandwidth usage. For most users, it just makes for a far nicer experience, bringing the convenience of consumer grade simplicity to managed enterprise devices. Everyone in the Apple MDM ecosystem I speak with has told me that DDM is the future for managed devices.

Michael Covington, Jamf vice president for portfolio strategy, last year noted the importance of this move. Pointing to DDM improvements at the time, he said: “Of course, the big announcement for those IT professionals responsible for managing devices is Apple’s improvements to Declarative Device Management. The new Software Update workflows demonstrate Apple’s commitment to iterating on the enhanced protocol….”

In this year’s biggest move toward that future, Apple’s new operating system software updates can now be managed entirely using DDM, replacing MDM profiles for software update restrictions, settings, and software update commands and queries.

A short summary of improvements for Apple admins

Of course, DDM is only one facet of device management, and while there are some unique differences between Mac and i-device platforms, Apple peppered the releases with new device management features:

• MDM can manage which Safari extensions are allowed, always on or always off, and what websites they can access.
• On supervised devices, organizations can disable a user’s ability to hide and lock apps.
• IT can prevent VPN settings from being modified by apps.
• A new MDM restriction can prevent the removal of an eSIM.
• New features in Calculator, such as Math Notes, Math Notes keyboard, scientific mode, and unit conversions can be managed in MDM. (This tool is aimed at education IT.)
• On a Mac, a new disk management configuration can be used to choose whether external or network storage is allowed or disallowed, or limit mounting to read-only volumes.
• Also on a Mac, MDM can configure hardware MAC address instead of a private MAC address on managed Wi-Fi networks. MDM can also prevent system extensions from being disabled in Settings.
• iPads gain an iPhone tool; IT can now use MDM to manage alternative marketplaces in regions in which those are supported.
• visionOS 2 now supports Automated Device Enrolment in MDM

For the most part, Apple’s enterprise improvements seem designed to give IT additional power to harden security across managed devices while also working to prevent data leaks. Companies in which security policy is attenuated also benefit from a small but noteworthy improvement in which users with complex passwords no longer need to lock and unlock the device to see the keyboard.

Apple’s complete lists

There are other features and tools listed across Apple’s documents detailing the enterprise-focused content in the latest OS upgrades. Apple’s pages detailing these improvements are here:

What’s new for enterprise in macOS Sequoia

What’s new for enterprise in iPadOS 18

What’s new for enterprise in iOS 18

What’s new for enterprise in visionOS 2

While many of the changes described above may be of less interest to most users, they will be of huge significance to the ever-growing cadre of Apple admins who are seizing seats across the enterprise as the company’s market share across that sector continues to grow. Apple is in business, from the world’s biggest firms to SMBs, and its continued focus on empowering MDM teams to support that proliferation now seems to run deep. Apple knows that, unlike the main enterprise tech incumbent, its products aren’t renowned for causing business disasters. It knows it has a story to tell, and for many in business in a world after the Crowdstrike mess, it also knows it offers a viable and robust alternative. 

Please follow me on Mastodon, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

Business spending to adopt and use AI in existing operations, and to deliver better products and services, is expected to drive 3.5% of global GDP by 2030, adding $19.9 trillion to the world economy, according to a new report from research firm IDC.

AI spending by businesses alone is expected to reach $632 billion by 2028, IDC had estimated in an earlier study.

As a result, AI will affect jobs across every region of the world, affecting industries from contact center operations to translation, accounting, and machinery inspection, according to IDC. Helping to trigger this shift are business leaders, 98% of whom view AI as a priority for their organizations.

David Foote, chief analyst and research officer with IT research firm Foote Partners, believes that 20% to 25% of tech jobs could eventually be taken by AI. “There have been a lot of layoffs,” he said. “Companies are identifying people who may have been solid workers in the past, but they don’t fit into the new world driven by the [emerging] economy and the technology they’re making bets on.”

While AI will reduce or eliminate the need for human input in some areas, it will also enhance productivity, requiring professionals to reskill and adapt to take on more strategic and creative roles, according to a research note by Foote. Along those lines, Goldman Sachs has projected that as many as 29% of computer-related job tasks could be automated by AI, as well as 28% of work by healthcare practitioners and technical tasks in that field. Careers with the highest exposure to AI automation are administrative positions (46%) and tasks in legal (44%) professions.

Nearly half of respondents to IDC’s Future of Work Employees Survey (48%) expect some parts of their work to be automated by AI and other tech over the next two years — and another 15% think most of their jobs will be automated. Only 3% expect their jobs to be fully automated.

Despite that disruption, however, AI will have a “net positive global economic impact,” according to the latest IDC report. In 2030, every new dollar spent on business-related AI solutions and services will generate $4.60 in the global economy in terms of indirect and induced effects.

Those impacts include:

• Increased spending on AI solutions and services driven by accelerated AI adoption;
• Economic stimulus among AI adopters, seeing benefits in terms of increased production and new revenue streams;
• And an increase in revenue across the AI providers supply chain including services providers.

“In 2024, AI entered a phase of accelerated development and deployment defined by widespread integration that’s led to a surge in enterprise investments aimed at significantly optimizing operational costs and timelines,” said Lapo Fioretti, an IDC senior research analyst. “By automating routine tasks and unlocking new efficiencies, AI will have profound economic consequences, reshaping industries, creating new markets, and altering the competitive landscape.”

New job roles to emerge

A survey of CFOs in June by Duke University and the Atlanta and Richmond Federal Reserve banks found that 32% of organizations plan to use AI in the next year to complete tasks once done by humans. And in the first six months of 2024, nearly 60% of companies (and 84% of large companies) said they had deployed software, equipment, or technology to automate tasks previously done by employees.

While some work is being negatively affected by the rapid proliferation of AI tools and platforms, new positions such as AI ethics specialists and AI prompt engineers will emerge as dedicated roles within global organizations.

IDC’s research also indicates that positions where human social and emotional capabilities are critical, such as nursing and roles where decision-making encompasses ethics and comprehension beyond numbers, will remain robust. “Understandably, we’re all curious to know if AI will replace our jobs,” said Rick Villars, IDC group vice president, for worldwide research.

As one CEO told IDC researchers, “Based on this research it’s clear that we should be asking ourselves how our jobs can be made easier and better by AI. AI will not replace your job but someone who knows how to use AI better than you will,” Villars added.

Has Apple’s love affair with AR cooled? Not on your life, and while it is true that visionOS didn’t get much time during the company’s big reveals at WWDC and last week’s iPhone launch, the company has delivered a handful of valuable improvements to the OS — hinting at future product plans as it did.

Perhaps you missed the hint, but what was interesting about the update wasn’t what’s new as much as what isn’t new, particularly the lack of support for Apple Intelligence. You could argue that this is only because the AI isn’t quite ready yet, but I can’t help but see its absence as a hint of what’s to come.

It’s always useful to cast about for a morsel of what Apple has actually said to support the theory. So, what has the company said? It’s already told us it’s working on a version of Siri with more contextual intelligence it hopes to ship in 2025.

That AI will be able to make contextual generative AI (genAI)-driven decisions in reaction to what it sees you interacting with on your iPhone, iPad, or Mac. Imagine what it will do if used with Vision Pro as it also looks around where you really are. If I’m right about this direction, it’s possible we’ll see visionOS equipped with a profoundly powerful contextual intelligence perhaps toward the end of next year. 

The Gift of Sound & Vision

Did I call this profound? Think about it: contextual intelligence is essential for an effective/responsive voice-driven interface at the intersection of technology and the everyday world. What you are looking at will change depending on your context, and the data your device surfaces will reflect the complexity of such complex lives. I see this as being Door Detection on steroids.I also think the gap between the idea and the reality will delay complete realization for a while — but it’s a beginning.

I also think that late 2025 time frame hints at Apple’s target release schedule for the slightly more mass market Vision 2.0 devices speculators expect. However, speculation doesn’t mean much these days until Bloomberg’s Mark Gurman’s “little birds” (Game of Thrones reference) begin to whisper. And I don’t think they’ve discussed how AI, voice, and contextual genAI will underpin dramatic new user interfaces across a multitude of consumer devices (plausibly including something designed by Jony Ive).

Let’s move away from speculation based on what didn’t happen to run through what’s actually changed.

Here’s a run-down on how Apple has expanded Spatial Reality:

The handy gesture

For me, the biggest improvement is around gesture. Apple has made it handy to access Home View and Control Center on Vision devices. To get to Home, you just need to use your hand — stare at your palm, then tap the dot that appears. If you turn your hand around you’ll be presented with time and battery information and can tap in that view to invoke Control Center or adjust volume controls. You can also now change the icon arrangement in Home, and avatar hand movements have been made smoother with new animations

Memories get Spatial

Apple made several tweaks to photos and videos: 

• You can turn existing photos into spatial images, adding depth to create a stereoscopic effect.
• The Photos app on Vision devices has been improved.
• You can share photos, videos, and panoramas during FaceTime calls using SharePlay.
• You get video trimming controls to use from within the headset.

(I’m quite interested to see the extent to which a future version of Apple Intelligence will be able to generate 3D environments from 2D photos you can then explore using Vision Pro. I believe that is inevitable.)

Apple

When you need a keyboard

You can use a Mac keyboard with Vision devices. In visionOS 2, the device will recognize your keyboard and display it on screen. This makes it much easier to use the input device. Apple has also introduced support for Bluetooth mice, which means you can navigate your device using a mouse and keyboard. A Messaging improvement means you can now dictate a message by staring at your microphone icon.

The infinite workspace

For work, perhaps one of the better enhancements (coming later this year) is the introduction of a new panoramic screen, equivalent to two 4K displays standing alongside each other. This really is giant real estate and should make complex workflows more possible.

On the web

The Safari browser lets Vision Pro users watch videos on a large display in any environment. Siri will read page content and Tab Group support makes it easier to handle multiple tabs. When you get time off, you get emoji reaction and singalong tools in Apple Music and the capacity to watch up to 5 MLS and MLB games in Multiview mode. (The latter feature is also expected later in the year.) You can also watch video in one window while working in other applications.

Virtuality and immersive environments

Apple expanded the number of immersive environments available in visionOS. It also improved the avatar system, so it captures more accurate skin tones and clothing colors. 

And the rest…

• Guest mode gives guests 30-day access to your device as it saves their eye and hand data.
• Live Captions provide real‑time transcriptions of speech, audio, and video content, including FaceTime calls.
• There’s a new travel mode for trains.

Please follow me on LinkedIn, Mastodon, or join me in the AppleHolic’s bar & grill group on MeWe.

Slack AI customers can now interact with AI “agents” in other apps, including Asana, Box and Anthropic’s Claude. 

The AI agents, accessible via a new chatbot interface in Slack, let users perform a range of actions in the integrated app, Slack said Monday. 

With the Asana agent, for instance, Slack users can “surface project insights and recommendations, such as status, blockers, next steps, and more,” parent company Salesforce said in a statement. The Adobe Express agent lets users create content such as graphics for social media posts from a prompt without leaving Slack. 

Other agents coming to Slack include Amazon Q Business, Cohere, Perplexity, and Writer.

Users can access the third-party agents via the Slack Marketplace or  create their own agent with “purpose-built APIs,” Slack said. 

A chatbot interface connects with parent company Salesforce’s CRM software. This involves access to Salesforce’s own Agentforce AI assistant, which has been rebranded from Einstein Copilot. From within Slack, the Agentforce AI can provide an update on the status of sales opportunities and cases, recommend next steps, draft emails, and more. 

Agentforce in Slack is slated to be available in beta next month. 

Other updates to Slack AI — the company’s paid AI service — include note taking in huddles voice and video calls. Here, the transcript of a huddle conversation is used to create a canvas document (Slack’s document editor tool) containing related information such as a meeting summary, action items, and links to relevant files. 

In Slack’s Workflow Builder, users can direct the AI assistant to generate a workflow automation using natural language prompts. 

The Slack AI search function gets an update, too; users can now surface results based on files uploaded or connected to a Slack workspace. Until now, Slack could only search conversations in the app; now the tool can retrieve information from sources such as canvas documents, Google and Microsoft documents, and files in connected apps, Slack said. 

Aside from AI-related features, Slack introduced new templates that can provide a starting point to help users begin a new project. A template for a marketing team could create a Slack channel with a standardized brief in a canvas document, a project plan in a Slack list, and an automated workflow for weekly status updates, the company said. 

Templates will be available in October.

Finally, Salesforce channels — available now to Slack Sales Elevate customers and later to Salesforce Starter Suite customers — are a new type of channel that connects Salesforce CRM records to conversations in a Slack workspace, enabling users to update CRM data without switching screens.

Along with iOS 18, Apple today is releasing macOS Sequoia, iPadOS 18, and the latest update to watchOS. (Apple Intelligence, which isn’t expected to begin to appear until next month, has gotten a lot of attention, but the pre-AI versions of these operating systems offer plenty of useful features and updates.)

Focusing today on macOS Sequoia, should you upgrade immediately? That depends. 

There are good things to tempt you, but you might need to wait — particularly if third-party services or applications you use (especially higher-end apps) don’t yet support the new OS.

If Apple Intelligence is the thing you’re most interested in, there’s no need to rush, since those tools won’t available until October in some countries, and next year in others. Global launch (including in Europe) will follow. Apple will also let Mac admins manage access to the service.

So, what’s Sequoia got to make you swoon if you ignore Apple Intelligence?

iOS, Mac, and iPhone: S.W.A.L.K.

What may turn out to be one of the most useful productivity-enhancing features in Sequoia is the increased integration between the Mac and iPhone. While EU customers won’t get this feature yet, iPhone Mirroring lets you use your iPhone on your Mac in a compact mini window. This lets you interact with iPhone apps via your Mac, and also lets you drag-&-drop files between the devices (though, that feature won’t debut until later this year). I think this could get really interesting if you use an iPad and a second Mac, too, as the implication is that you’ll be able to move files and folders around between the machines to your heart’s content in a quite focused way.

A second integration means notifications received on your iPhone can also appear on your Mac. 

Manage busy desktops

Dragging a window to the edge of the screen will automatically place that window in a tile in the main window. This works across multiple windows, making it much easier to parse information from numerous websites and applications in one clear to the eye view. You can shift windows around, if you like.

Solving the eternal presentation headache

If you use Webex, Zoom, or even FaceTime, Sequoia will show you a view of what will be made visible to other meeting attendees when they share their screen before they actually share it. If you’ve ever unexpectedly needed to share a document during a meeting while other confidential items are open on your Mac, you’ll recognize what a small but handy improvement this is.

Even experienced Zoom hosts can’t help but exhale a little when they share their screen, as this is never quite as certain as you need for comfort. Now, it is.

Safari redesigned to get web clutter out of your way

Safari is smarter than before. You’ll be able to read page summaries or gather together links at the touch of a button. Reader view has been improved with a variety of features, including auto-generated table of contents to make navigating complex pages much easier. If a page features video, Safari will either open the clip in a big window or pop it inside a smaller pop-up window if you decide to navigate to another site while leaving the original site window open.

Finally, Safari will let you hide distracting items such as subscription pop-ups from view when you visit a site. 

Notes, Reminders, and Calendar

Just as on the iPhone, Mac users can expect audio transcription and summarization features in Notes when Apple Intelligence appears. The app has also become more capable, with collapsible section headers and different text and highlight colors. Finally, if you record a call taken on your iPhone, a transcript will be created that can also sync with Notes on your Mac.

Calendar and Reminders work more smoothly now, with Reminder tasks showing up in Calendar and a Month view that lets you see both Calendar and Reminder entries at a glance.

Apple

The Password application

Apple’s all-new Password application is a new skin on Keychain, making the information — passwords, passkeys, Wi-Fi passwords — much more accessible and usable than before. The app uses iCloud to sync across all your logged-in Apple devices (and Windows hardware using the iCloud for Windows application).

Better collaboration tools

Freeform remains a really useful collaborative space where teams can work on ideas together from whatever Apple device they happen to use. On the Mac, the latest iteration includes a new diagramming mode to connect different objects and usability improvements when moving around a large board using a mouse.

Some Siri intelligence

Kick the system around and you’ll find a new accessibility tool that lets you make custom voice commands to invoke Shortcuts. You might use this to set up a tool that lets you ask Siri to create a PDF from what you are reading on a Mac, for example. You can find these options in System Settings>Accessibility>Vocal Shortcuts.

Smaller, useful tweaks

A handful of additional system tweaks wipe old annoyances away. You can schedule when messages are sent, for example. Another change allows you to install larger applications (more than 1GB) on external drives, subject to some restrictions. You also won’t need to have double the amount of space for an app on your drive to install it. 

In addition:

• An updated Calculator application lets you see mathematical expressions and previous calculations, and integrates with Notes to create what Apple calls Math Notes. The latter is essentially a way to do algebraic equations on your Mac. 
• There’s a new Keep Downloaded option that will ensure a local copy of a file is kept on your Mac rather than being stored in iCloud.

One more thing? 

Apple has shipped a Chess application with Macs for decades. Yet the last time this got updated was with Mac OS X 10.3 Panther — 20 years ago. The historically important game, probably included in the Mac because Steve Jobs liked Chess so much, clearly isn’t on Apple’s speedy upgrade cycle. In Sequoia, it finally gets a makeover with new graphics, though sadly without a 3D or Kriegspiel mode.

Which Macs does macOS Sequoia work with?

If you ignore Apple Intelligence, the new Mac operating system is compatible with the following devices:

• MacBook Pro (2018 and later).
• MacBook Air (2020 and later). 
• Mac mini (2018 and later).
• iMac (2019 and later). 
• iMac Pro (2017 and later). 
• Mac Pro (2019 and later). 
• Mac Studio (2022 and later).

The problem is that not all of the above devices support Apple Intelligence. To use Apple Intelligence, you need to be working with a Mac running an M1 or later Apple Silicon chip. No Intel Macs will run Apple Intelligence.

Finally, on security — once macOS Sequoia is available, it will be the only version to receive full security updates in the next 12 months. The two most recent versions (Sonoma and Ventura) will get some updates, but Monterey and earlier versions will get none. This means that if you rely on Macs, it’s worth ensuring you know which machines you run, what version of the OS they use, and what data they have access to.

Please follow me on LinkedIn, Mastodon, or join me in the AppleHolic’s bar & grill group on MeWe.

Addressing four zero-days flaws (CVE-2024-38014, CVE-2024-38217, CVE-2024-43491 and CVE-2024-38217), this month’s Patch Tuesday release from Microsoft includes 79 updates to the Windows platform. There are no patches to Microsoft Exchange Server or the company’s development tools (Visual Studio or .NET). And Microsoft addressed a recently exploited vulnerability in Microsoft Publisher with two critical updates and nine patches rated important for Microsoft Office. 

Significant testing will be required for this month’s Microsoft SQL Server patches, which affect both server and desktop components — with a focus on application installations due to a change in how Microsoft Installer handles changes and installation rollbacks.

The team at Readiness has crafted a useful infographic outlining the risks associated with each update. 

Known issues 

Microsoft always publishes a list of known issues that relate to the operating system and platforms included in each update, including the following two minor issues for September:

• After installing the Windows update released on or after July 9, 2024, some Windows Servers may experience intermittent interruptions to remote desktop connections. Those using RDP over HTTP while employing a Remote Gateway server are most likely to experience this issue. Microsoft is working on a resolution and published a knowledge article (KB5041160) to assist with mitigations.
• As a result of the recent updates to Microsoft SharePoint Server, some users are reporting an issue in which SharePoint workflows can’t be published because the unauthorized type is blocked. The issue also generates the event tag “c42q0” in SharePoint Unified Logging System (ULS) logs. In addition, recent changes could cause the deserialization of custom types that inherit from IDictionary to fail. For more information, see KB5043462 on these issues. (Sounds like something from the Succession TV series.)

Due to recent changes to Windows Installer, User Account Control (UAC) does not prompt for credentials on application installation repairs. Once this update (September 2024) has been installed, UAC will again prompt properly. Your scripts will need to be updated if you have not already accounted for this change. 

Though Microsoft has provided documentation on avoiding the issue by disabling this feature in UAC, we think this is a much-needed change and recommend following this latest best practice.

Major revisions 

This month, Microsoft published the following major revisions to past security and feature updates, including:

• CVE-2020-17042: Windows Print Spooler Remote Code Execution Vulnerability. This print spooler update was first released in November 2020. This is an information update to reflect that Windows Server 2022 (Core) is now affected.
• CVE-2024-30077: Windows OLE Remote Code Execution Vulnerability. This two-month-old patch from Microsoft has been updated to include support for the ARM platform. 
• CVE-2024-35272: SQL Server Native Client OLE DB Provider Remote Code Execution. First released in July, the affected software table has been updated to include entries for Visual Studio 2019 and 2022. No further action required.
• CVE-2024-38138: Windows Deployment Services Remote Code Execution Vulnerability. This is a documentation update to a patch released last month to include support for all supported versions of Windows Server. No further action required.

Unusually, we have a patch revision that is not strictly documentation related. This month, it’s CVE-2024-38063 (Windows TCP/IP Remote Code Execution Vulnerability). Unlike other revisions, this latest version of a critical network patch will require testing as if it were a new update. System administrators need to take this latest patch revision seriously and test before (re)deployment.

Testing guidelines

Each month, the Readiness team analyzes the latest Patch Tuesday updates and provides detailed, actionable testing guidance based on a large application portfolio and a detailed analysis of the patches and their potential impact.

For September, we have grouped the critical updates and required testing efforts into separate product and functional areas including:

Microsoft SQL Server

Microsoft released several updates to the Microsoft SQL Server platform that affects both Windows desktops and SQL Server installations, including:

• A significant update to all supported versions (2016-2022) of Microsoft SQL Server that will require a full installation test. 
• An updated core Windows library (SQLOLEDB) that helps Windows applications communicate with SQL Server databases and tools. Though Microsoft rated this change low-risk, Readiness recommends a portfolio analysis that highlights all apps that depend on this data-bound communication approach and a full test cycle for each one identified.

Due to the nature of this September SQL Server update, we highly recommend testing the patch itself and the patching process — with a view to the patch REMOVAL process. We understand that this will require time, skill, and effort — but it will be better than a full restore from backup. 

Windows

Microsoft made networking and memory handling security issues a focus this month with the following changes to Windows:

• Due to an update to 64-bit to 32-bit memory handling in Windows (called thunking), 32-bit Camera applications will require testing on 64-bit machines this month. Using Microsoft Teams or playing a video from a USB drive would provide good testing coverage for this change.
• Virtual Machines (VMs) that require a VPN will require connectivity testing. In addition, the following protocols — PPP, PPTP, SSTP — will require a basic connectivity test. 
• A minor update to Windows defender will require basic testing for endpoint security.
• A minor update to core networking functions will require a test of high network traffic this month. The focus should be on the transfer of large files using applications such Teams, Outlook and Microsoft Edge.

Microsoft delivered a significant update to the MSI Installer (application installer) sub-system that will require application install level testing for a portion of your portfolio. Part of this update relates to how shell links are handled in the storage subsystem, which might cause redirected folders or shortcuts to behave unexpectedly during an installation — particularly on secure or locked-down configurations.

We suggest that installations, rollbacks, un-installations and UAC checks be validated this month. Checking for “zero” exit codes on the MSI Installer log is always a good start.

Windows lifecycle and enforcement updates

This section contains important changes to servicing, significant feature depredations, and security related enforcements across the Windows desktop and server platforms.

• Enforcements: Microsoft Entra now requires TLS 1.2 (using the latest Microsoft cryptographic libraries) as defined by RFC5246. Microsoft has published several scripts to assist with assessing whether your clients are using the latest libraries and protocols (they’re found here).
• Lifecycle: General support for Microsoft SQL Server 2019 ends in January 2025. Given the large number of updates to this aging server, it might be time to upgrade.

Mitigations and workarounds

Microsoft did not publish any mitigations or workarounds this month.

Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings: 

• Browsers (Microsoft IE and Edge).
• Microsoft Windows (both desktop and server).
• Microsoft Office.
• Microsoft Exchange Server.
• Microsoft Development platforms (ASP.NET Core, .NET Core and Chakra Core).
• Adobe (if you get this far).

Browsers

Microsoft’s Edge browser no longer synchronizes exactly with Patch Tuesday; there were several updates to Microsoft’s version of the Chromium browser that address the following reported vulnerabilities:

• CVE-2024-41879: Adobe PDF Viewer (Gotcha!)
• CVE-2024-38208: Edge for Android updates.
• CVE-2024-38207: Microsoft MSHTML Memory Issues.
• CVE-2024-38210 and CVE-2024-38209: Microsoft Remote Code Execution.

Once we are done with the Microsoft updates, we can focus on these Chromium patches:

• CVE-2024-8636: Heap buffer overflow in Skia.
• CVE-2024-8637: Use after free in Media Router.
• CVE-2024-8638: Type Confusion in V8 (JavaScript).
• CVE-2024-8639: Use after free in Autofill.

After checking for compatibility or suitability challenges presented by these changes, we have not seen anything in the Edge or Chromium update that could affect most enterprise deployments. Add these browser updates to your standard release schedule.

Windows

Microsoft released two critical rated updates to the Windows platform (CVE-2024-38119 and CVE-2024-43491) and 43 patches rated important. The following Windows features have been updated:

• Windows Update and Installer.
• Windows Hyper-V.
• Windows Kernel and Graphics (GDI).
• Microsoft MSHTML and Mark of the Web.
• Remote Desktop (RDP) and TCP/IP subsystems.

The real concern is that three of these vulnerabilities (CVE-2024-38014, CVE-2024-38217, CVE-2024-43491 have been reported as exploited. In addition, another reported vulnerability in the Windows HTML subsystem (CVE-2024-38217) has been reported as publicly disclosed. Given these four zero-days, we recommend that you add these Windows updates to your Patch Now release schedule.

Microsoft Office 

Microsoft addressed two critical vulnerabilities in the SharePoint platform (CVE-2024-38018 and CVE-2024-43464) that will require immediate attention. There are nine other updates rated important that affect Microsoft Office, Publisher and Visio. Unfortunately, CVE-2024-38226 (which affects Publisher) has been reported as exploited in the wild by Microsoft. If your application portfolio does not include Publisher (many don’t) then add these Microsoft updates to your standard patch release cycle.

Microsoft SQL (nee Exchange) Server 

This month brings a significantly larger update to the Microsoft SQL Server platform with 15 updates (all) rated as important. There are no reports of public disclosures or active exploits, and these patches cover the following broad vulnerabilities:

• Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability.
• Microsoft SQL Server Native Scoring Information Disclosure Vulnerability.
• Microsoft SQL Server Information Disclosure Vulnerability.
• Microsoft SQL Server Elevation of Privilege Vulnerability.

Though there will be a significant testing profile this month, affecting both server and desktop systems, we suggest you add these SQL Server patches to your standard release schedule. 

Microsoft development platforms 

No development tools or features (Microsoft Visual Studio or .NET) have been updated this month.

Adobe Reader (and other third-party updates) 

Things are a little different this month for Adobe Reader. Normally, Microsoft releases an Adobe Reader update to the Windows platforms. Not so, this month. 

Adobe Reader has been updated (APSB24-70) but has not been included in the Microsoft release. This month’s Adobe Reader update addresses two critical memory-related security vulnerabilities and should be added to your standard app release cycle.