The January 2023 Patch Tuesday Security Update Review | Qualys

Summary: Microsoft released 98 new patches for January 2023, 11 rated critical and 87 rated important, covering Windows, Office, Exchange Server, .NET Core, Visual Studio Code, Azure Service Fabric Container, Windows Defender, and BitLocker. One vulnerability was publicly known and one was actively exploited at release, while Adobe issued four patches covering 29 vulnerabilities in Acrobat and Reader, Dimension, InCopy, and InDesign, with no known active attacks.
What's compelling: CVE-2023-21674, a Windows ALPC elevation-of-privilege flaw reported by Avast, is being actively exploited to gain kernel-level execution and SYSTEM privileges, and such bugs are frequently paired with malware or ransomware delivery. Windows 7, Windows Server 2008, and Windows Server 2008 R2 also reached the end of Extended support, so those systems will no longer receive security patches.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-21674
Related: CVE-2023-21674: Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Jan 10, 2023
Microsoft Patch Tuesday, January 2023 Edition Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026