Pierluigi Paganini April 12, 2022

Microsoft Partch Tuesday security updates for April 2022 fixed 128 vulnerabilities, including an actively exploited zero-day reported by NSA.

Microsoft Partch Tuesday security updates for April 2022 fixed 128 vulnerabilities in multiple products, including Microsoft Windows and Windows Components, Microsoft Defender and Defender for Endpoint, Microsoft Dynamics, Microsoft Edge (Chromium-based), Exchange Server, Office and Office Components, SharePoint Server, Windows Hyper-V, DNS Server, Skype for Business, .NET and Visual Studio, Windows App Store, and Windows Print Spooler Components.

Ten of the 128 vulnerabilities fixed by Microsoft are rated Critical, 115 are rated Important, and three are rated Moderate in severity.

One of these flaws, tracked as CVE-2022-24521 (CVSS score 7.8), is a Windows Common Log File System Driver Elevation of Privilege issue that is actively exploited. The flaw was reported by the NSA that likely observed its exploitation in attacks conducted by APT groups.

Another flaw, tracked as CVE-2022-26904 (CVSS score 7), is a Windows User Profile Service Elevation of Privilege Vulnerability listed as publicly known at the time of release.

One of the most severe issues addressed with the release of Patch Tuesday Security Updates for April 2022 is an RPC Runtime Library Remote Code Execution flaw (CVE-2022-26809 CVSS 9.8).

“The vulnerability could allow a remote attacker to executed code at high privileges on an affected system. Since no user interaction is required, these factors combine to make this wormable, at least between machine where RPC can be reached. However, the static port used here (TCP port 135) is typically blocked at the network perimeter.” reported ZDI. “Still, this bug could be used for lateral movement by an attacker. Definitely test and deploy this one quickly.”

Some of the most severe issues fixed by the IT giant are two Windows Network File System Remote Code Execution Vulnerability tracked as CVE-2022-24491 and CVE-2022-24497 respectively.

The complete list of CVEs released by Microsoft for April 2022 is here.

Please vote for Security Affairs as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog” and others of your choice.
To nominate, please visit: https://docs.google.com/forms/d/e/1FAIpQLSfxxrxICiMZ9QM9iiPuMQIC-IoM-NpQMOsFZnJXrBQRYJGCOw/viewform  

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Microsoft Partch Tuesday)

[adrotate banner=”5″]

[adrotate banner=”13″]