Microsoft Patch Tuesday, October 2022 Edition
Summary: Microsoft released updates fixing at least 85 security holes in Windows and related software, including a new zero-day elevation-of-privilege flaw in the Windows COM+ event service, CVE-2022-41033, that is being actively exploited. The October 2022 Patch Tuesday contained no fixes for the two Exchange Server zero-days known as ProxyNotShell, which can be chained for remote code execution and which Microsoft has been mitigating with guidance that was soon shown to be ineffective.
Why it matters: Rapid7 observed more than 190,000 potentially vulnerable Exchange Server instances exposed to the Internet as of early September 2022, and Microsoft's recommended rule for blocking known attack patterns has been bypassed multiple times.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-37968CVE-2022-41033
- Related
- CVE-2022-41033: Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Oct 11, 2022