WHEN UPDATES BACKFIRE: RCE IN WINDOWS UPDATE HEALTH TOOLS

Summary from the TLDR InfoSec newsletter

Researchers at Eye Security uncovered a remote code execution flaw in Microsoft's Update Health Tools (KB4023057), traced to abandoned Azure blob storage. Attackers could trigger unintended code execution on vulnerable devices by exploiting predictable blob names and weak message security. Microsoft confirmed the issue, transferred ownership of the exposed blobs, and improved protections in newer tool versions, mitigating risks for most users.