Microsoft Patch Tuesday includes most vulnerabilities since Sept. 2020
Summary: Microsoft's latest Patch Tuesday disclosed more than 140 vulnerabilities across its products, the largest single Patch Tuesday since September 2020, with ten rated critical, three moderate and the rest important. Three critical remote code execution flaws sit in Windows Hyper-V (CVE-2022-23257, CVE-2022-24537, CVE-2022-22008), two more in Windows Network File System (CVE-2022-24491, CVE-2022-24497), one in Windows SMB (CVE-2022-24500) and one in LDAP (CVE-2022-26919).
What's compelling: The Hyper-V flaws let an attacker run code on a guest and have the host execute arbitrary code, and the SMB flaw can be triggered by tricking a user into visiting a malicious SMB server - which is why Talos notes blocking TCP port 445 at the perimeter as a mitigation.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-22008CVE-2022-23257CVE-2022-24491CVE-2022-24497CVE-2022-24500CVE-2022-24537CVE-2022-26919
- Related
- Microsoft Patch Tuesday, April 2022 Edition Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026