Microsoft has patched potentially critical vulnerabilities in Update Catalog and Windows Defender on the server side.