This week was November’s patch Tuesday, where Microsoft issued a security update that resolved 68 different vulnerabilities, 6 of which were actively exploited zero-day flaws. A total of 11 vulnerabilities that have been patched this week have been given a critical severity rating, due to a possible exploit leading to elevation of privileges, spoofing, or remote code execution. A non-security update was also issued for both Windows 10 and Windows 11 as a part of this month’s patch Tuesday. 

One of the zero-day vulnerabilities that was fixed in this security update is the Windows Mark of the Web (MotW) flaw, that affected Microsoft Office applications. This vulnerability is tracked as CVE-2022-41049, and covers various MotW bypass bugs, some of which have been actively exploited. An unofficial patch for one of these bugs was made available last month, however installing the new Windows security updates to patch this flaw will provide better protection from attack. Two zero-day Microsoft Exchange Server vulnerabilities, CVE-2022-41082 and CVE-2022-41040, were also patched in this recent update. These high severity flaws can be exploited together to allow attackers to elevate privileges, and then trigger remote code execution. Proof of Concept (PoC) code has been available for an exploit of these vulnerabilities since last month, when they were also added to the Cybersecurity and Infrastructure Security Agency’s (CISA) known exploited vulnerabilities catalog.  

The other zero-day vulnerabilities fixed include a remote code execution vulnerability, CVE-2022-41128, that allows attackers to use a malicious website to abuse Windows scripting languages and execute code. This vulnerability is known to be actively exploited, and uses the Jscript9 scripting language. The final two zero-days patched are elevation of privilege vulnerabilities, which could allow an attacker who exploits them to gain SYSTEM privileges. CVE-2022-41073 is a vulnerability in the Windows print spooler, and CVE-2022-41125 occurs in the Windows CNG key isolation service. Both of these vulnerabilities are also known to have been exploited.  

This month’s updates contain important patches for many known exploited and critical severity flaws, so should be applied to devices as soon as possible. The Microsoft update guide contains links to access all security updates, and a list of the CVE’s that each patch.