October 2022 Patch Tuesday | Microsoft Releases 84 Vulnerabilities With 13 Critical, Plus 12 Microsoft Edge (Chromium-Based); Adobe Releases 4 Advisories, 29 Vulnerabilities With 17 Critical. | Qualys
Summary: Microsoft's October 2022 Patch Tuesday fixed 84 vulnerabilities, 13 of them critical, including two zero-days of which CVE-2022-41033 was actively exploited. Microsoft did not release fixes for the two actively exploited Exchange zero-days tracked as CVE-2022-41040 and CVE-2022-41082, collectively called ProxyNotShell, and Adobe issued four advisories covering 29 vulnerabilities, 17 rated critical.
Bottom line: Two Exchange zero-days were under active exploitation with no patch, and Microsoft had already revised its suggested URL rewrite mitigation more than once after it was bypassed, leaving defenders to hold the line with workarounds alone.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-41033CVE-2022-41035CVE-2022-41040CVE-2022-41043CVE-2022-41082
- Related
- Microsoft: Two New 0-Day Flaws in Exchange Server Cyber Risks ·Patch Tuesday, November 2022 Election Edition Cyber Risks ·Threat Brief: OWASSRF Vulnerability Exploitation Cyber Risks ·