Microsoft Patches Windows Flaw Under Attack and Reported by NSA

Microsoft today issued 128 patches in a total of 145 CVEs this month for security vulnerabilities in Windows, Defender, Edge, Exchange Server, Office, SharePoint, DNS server, Windows Print Spooler, and other software.

An elevation of privilege flaw in Windows Common Log File System Driver CVE-2022-24521 is already being exploited in the wild, and was reported to Microsoft by the National Security Agency and researchers from CrowdStrike. "Since this vulnerability only allows a privilege escalation, it is likely paired with a separate code execution bug," ZDI wrote in its analysis of the April batch of Microsoft patches. "It's not stated how widely the exploit is being used in the wild, but it's likely still targeted at this point and not broadly available. Go patch your systems before that situation changes."

There are 10 critical vulns among the security updates today, including two that ZDI says could be abused as worms: a remote code execution bug in RPC Runtime Library (CVE-2022-26809) and a remote code execution flaw in Windows Network File System (CVE-2022-24491/24497).