‘Wormable’ Flaw Leads January 2022 Patch Tuesday

Summary: Microsoft's January 2022 Patch Tuesday fixed nearly 120 security holes in Windows and supported software, including nine rated critical and six already publicly detailed. The most severe is CVE-2022-21907, a critical remote code execution flaw in the HTTP Protocol Stack affecting Windows 10, Windows 11, Server 2019 and Server 2022 that Microsoft describes as wormable, requiring no human interaction to spread between vulnerable Windows systems.
Key Takeaway: Microsoft patched a similarly critical and wormable HTTP Protocol Stack flaw in May 2021, and exploit code was posted online less than a week later - a timeline that gives defenders days, not months, before a working attack exists.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-22947 CVE-2021-36976 CVE-2022-21840 CVE-2022-21846 CVE-2022-21907
Related: Microsoft Patch Tuesday for Jan. 2022 — Snort rules and prominent vulnerabilities Cyber Risks ·
Threat Source Newsletter (Jan. 13, 2022) Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026