Critical remote code execution and elevation of privilege vulnerabilities were among the 75 total vulnerabilities that have been fixed in Microsoft’s May Patch Tuesday this week.

These essential patches include fixes for currently exploited zero-day vulnerabilities, one of which is a novel NTLM relay attack, identified as CVE-2022-26925, which affects all versions of Windows. This vulnerability allows malicious actors to exploit a Local Security Authority flaw through a man in the middle attack. Unauthorised users could force the domain controller to authenticate their access requests with elevated privilege, even going so far as access at the domain controller level. This was managed by intercepting legitimate authentication requests of local and remote sign-ins. Microsoft have also produced a report that can be read alongside the installation of this patch in order to provide information and advice on how to mitigate these sorts of NTLM relay attacks in the future.

Two further zero-day vulnerabilities were also patched with this update, further protecting users from publicly exposed flaws. The first of these is a Windows Hyper-V denial of service vulnerability tracked as CVE-2022-22713. The other affects Insight Software and is an argument injection vulnerability in the browser based authentication module – this has been designated CVE-2022-29972 for the Magnitude Simba Amazon Redshift ODBC Driver, and it could allow the user to execute arbitrary code.

Other important vulnerabilities that have been included in this release are information disclosure, denial of service, security feature bypass, and spoofing vulnerabilities – as well as a low severity .NET Framework Denial of Service Vulnerability.

A recent surge in zero-day threats emphasises the importance of this new patch that addresses such flaws. Now that these 75 vulnerabilities have all been disclosed and publicised through the release of this security update, it is important to install this as soon as possible, as malicious threat actors now have the capabilities to devise their own exploits of these vulnerabilities.