Microsoft Patch Tuesday, July 2022 Edition

Summary: Microsoft released updates for at least 86 security vulnerabilities in Windows and other software, including CVE-2022-22047, an elevation-of-privilege flaw in all supported Windows versions that Microsoft says is actively exploited. Microsoft also reversed its plan to block VBA macros in Office documents downloaded from the Internet, citing user feedback, and said the rollback is temporary without giving a date for reinstating it.
What you should know: CVE-2022-22047 lets an attacker run code as SYSTEM once they can execute other code on the target, and researchers note such bugs are typically paired with a malicious Office or Adobe document - the same macro path Microsoft just left open by default.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2022-22022 CVE-2022-22041 CVE-2022-22047 CVE-2022-30206 CVE-2022-30226
Related: CVE-2022-22047: Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Jul 12, 2022
July 2022 Patch Tuesday | Microsoft Releases 84 Vulnerabilities with 4 Critical, plus 2 Microsoft Edge (Chromium-Based) | Qualys Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026