Microsoft Patches Six Zero-Day Bugs this Month

Microsoft introduced a somewhat reduced number of security updates on Patch Tuesday yesterday, but six of the CVEs are staying actively exploited in the wild.

Amid these are the so-termed “ProxyNotShell” bugs in Microsoft Trade Server initially exposed in September. Elevation of privilege vulnerability CVE-2022-41040 and remote code execution (RCE) bug CVE-2022-41082 are staying exploited by Chinese threat actors, according to Automox senior product manager, Preetham Gurram.

“We propose implementing patches within just 24 several hours if you have vulnerable on-prem or hybrid exchange servers the place short term mitigation has not been used,” he said.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The other zero-times completely ready for patching this month consist of critical RCE vulnerability CVE-2022-41128, which impacts the JScript9 scripting language, and CVE-2022-41073, which has an effect on Windows Print Spooler.

CVE-2022-41125 is a privilege escalation vulnerability impacting the Windows Up coming-Era Cryptography (CNG) Key Isolation support, while CVE-2022-41091 is described as a Windows Mark of the Web (MotW) security function bypass vulnerability and was widely publicized in October.

The function for Exchange Server shoppers does not end with patching the ProxyNotShell CVEs, according to Quick7 direct item manager, Greg Wiseman.

“Four other CVEs influencing Trade Server have also been resolved this thirty day period. Three are rated as significant, and CVE-2022-41080 is an additional privilege escalation vulnerability viewed as critical,” he stated.

“Customers are advised to update their Exchange Server systems straight away, irrespective of no matter whether any previously advisable mitigation measures have been utilized. The mitigation principles are no extended proposed when methods have been patched.”

Microsoft also produced a non-CVE security advisory this month its third of the 12 months.

ADV220003 is a “defense-in-depth” update for Microsoft Business 2013 and 2016.

According to Wiseman, it “improves validation of paperwork secured through Microsoft’s Data Legal rights Management (IRM) technology – a function of to some degree dubious value.”

Microsoft preset a complete of 68 vulnerabilities this month, such as 11 rated critical.