Microsoft Patch Tuesday, April 2022 Edition
Summary: Microsoft released updates fixing roughly 120 security vulnerabilities in Windows and other software, including CVE-2022-24521, a privilege escalation flaw in the Windows common log file system driver that Microsoft says the NSA reported is under active attack. Nine updates address flaws Microsoft rates critical, among them CVE-2022-26809, a potentially wormable RPC weakness with a CVSS score of 9.8 that Microsoft believes is more likely than not to be exploited.
Bottom line: One of this month's flaws is already being exploited in the wild, and the 9.8-scored RPC and NFS bugs are rated by Microsoft as more likely to be exploited, with wormable potential that researchers note could appeal to ransomware operators.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-24491CVE-2022-24497CVE-2022-24500CVE-2022-24521CVE-2022-26809
- Related
- CVE-2022-24521: Microsoft Windows CLFS Driver Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Apr 13, 2022Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday Cyber Risks ·