Microsoft Patch Tuesday, August 2022 Edition

Summary: Microsoft released updates fixing a record 141 security vulnerabilities in its Windows operating systems and related software, including a zero-day in the Microsoft Support Diagnostics Tool tracked as CVE-2022-34713 and a second MSDT flaw tagged CVE-2022-35743. The company also patched a publicly disclosed Exchange Server information disclosure flaw, CVE-2022-30134, plus three critical Exchange bugs tracked as CVE-2022-24477, CVE-2022-24516 and CVE-2022-21980.
What's compelling: Microsoft says protecting Exchange this month requires administrators to enable Windows Extended Protection on Exchange Servers, and Kevin Breen of Immerse Labs notes that with CVE-2022-24477 an attacker could take over the mailboxes of all Exchange users - the same class of flaw that let hackers worldwide compromise the local Exchange systems of hundreds of thousands of organizations a little over a year ago.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2022-21980 CVE-2022-24477 CVE-2022-24516 CVE-2022-30133 CVE-2022-30134 CVE-2022-34691 CVE-2022-34713 CVE-2022-35743
Related: August 2022 Patch Tuesday | Microsoft Releases 121 Vulnerabilities With 17 Critical, Plus 20 Microsoft Edge (Chromium-Based); Adobe Releases 5 Advisories, 25 Vulnerabilities With 15 Critical. | Qualys Cyber Risks ·
CVE-2022-34713: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Aug 09, 2022
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026