Microsoft Patch Tuesday – April 2022

This month, Microsoft has fixed 119 vulnerabilities, including 10 criticals and also 2 zero-days.

CVE-2022-24521 and CVE-2022-26904 are “only” privilege escalation vulnerabilities but combined with other bugs they might allow an attacker to code execution at the SYSTEM level. Due to exploitation of the first one is already detected and the second one is rated as “exploitation more likely”, please consider patching ASAP.

CVE-2022-26809 is marked as “exploitation more likely” and could allow a remote attacker to execute code with high privileges on an affected system. No user interaction is required, so it might be used between machines where RPC can be reached. Please check if TCP/135 is blocked at the network perimeter (typical scenario) to eliminate risk from outside, but definitely put a high priority on that one.

CVE-2022-24491 and CVE-2022-24497 occur only on systems with the NFS role enabled. Once again, a remote attacker could execute code with high privileges and without user interaction. Very similar situation to the above one – please check if ports are blocked at the network perimeter, especially port 2049. Also, high priority!

Below you can see the most important CVEs released by Microsoft for April 2022 (zero-days, critical, and with CVSS at least 8.0). Besides the vulnerabilities already mentioned, you can find also several quite interesting ones concerning SMB, LDAP, DNS, Kerberos, or RDP.