Microsoft Patch Tuesday for Jan. 2022 — Snort rules and prominent vulnerabilities

Summary: Microsoft's January 2022 security update disclosed 102 vulnerabilities, the largest monthly total in eight months, including nine rated critical; Microsoft said none had been exploited in the wild. Notable entries include CVE-2022-21840, a critical Office remote code execution flaw triggered by opening a crafted document, three remote code execution flaws in Microsoft Edge, and CVE-2022-21846 in Exchange Server, which Microsoft considers more likely to be exploited.
Why it matters: Microsoft flagged the Exchange Server flaw CVE-2022-21846 as more likely to be exploited, and Exchange spent the prior year under attack from zero-days used by the Hafnium APT and, in November, by Babuk ransomware.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2022-21837 CVE-2022-21840 CVE-2022-21841 CVE-2022-21842 CVE-2022-21846 CVE-2022-21855 CVE-2022-21929 CVE-2022-21930 CVE-2022-21931 CVE-2022-21969
Related: Threat Source Newsletter (Jan. 13, 2022) Cyber Risks ·
‘Wormable’ Flaw Leads January 2022 Patch Tuesday Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026