Report Name: Microsoft Patch Tuesday, April 2022
Generated: 2022-04-21 20:24:02

Product Name	Prevalence	U	C	H	M	L	Comment
Kerberos	1			1	2		Kerberos
Windows SMB	1			1			Windows SMB
Remote Procedure Call Runtime	0.9		3				Remote Procedure Call Runtime
Windows DNS Server	0.9			17	1		Windows DNS Server
Windows Kernel	0.9			9	11		Windows Kernel
Windows Win32k	0.9			1	2		Windows kernel-mode driver
.NET Framework	0.8			1			.NET Framework
Cluster Client Failover	0.8				1		Windows component
Connected User Experiences and Telemetry	0.8				1		Windows component
DiskUsage.exe	0.8			1			Windows component
Microsoft Defender	0.8				1		Anti-malware component of Microsoft Windows
Microsoft Edge	0.8		1		28	9	Web browser
Microsoft Local Security Authority Server	0.8			1	2		LSASS, the Windows Local Security Authority Server process, handles Windows security mechanisms
Microsoft PowerShell	0.8				1		PowerShell or Microsoft PowerShell (formerly Windows PowerShell) is a task automation and configuration management program from Microsoft, consisting of a command-line shell and the associated scripting language
Win32 File Enumeration	0.8			1			Windows component
Win32 Stream Enumeration	0.8			2			Windows component
Windows Ancillary Function Driver for WinSock	0.8				1		Windows component
Windows Bluetooth Driver	0.8				1		Windows component
Windows Common Log File System Driver	0.8		1		1		Windows component
Windows DWM Core Library	0.8				1		Windows component
Windows Graphics Component	0.8			1	1		Windows Graphics Component
Windows Installer	0.8				2		Windows Installer
Windows Network File System	0.8			2			Windows Network File System
Windows Print Spooler	0.8				15		Windows component
Windows Remote Desktop Protocol	0.8			1			Windows component
Windows User Profile Service	0.8			1			Windows component
.NET	0.7				1		.NET
HEVC Video Extensions	0.7			1			HEVC Video Extensions
Microsoft SharePoint	0.7				1		Microsoft SharePoint
Windows Desktop Bridge	0.7				1		Windows Desktop Bridge
Windows Fax Compose Form	0.7			3			Windows component
Microsoft Excel	0.6			2			MS Office product
Skype for Business	0.6				2		Skype for Business
Windows Hyper-V	0.6			4	5		Hardware virtualization component of the client editions of Windows NT
Microsoft Dynamics 365	0.5			1			Microsoft Dynamics 365 is a product line of enterprise resource planning (ERP) and customer relationship management (CRM) intelligent business applications
YARP	0.5				1		Yet Another Reverse Proxy. YARP is a library to help create reverse proxy servers that are high-performance, production-ready, and highly customizable
Azure	0.4				3		Azure
Git	0.4				1	1	Git
Power BI	0.3				1		Power BI is a business analytics service by Microsoft
Visual Studio	0.3				2		Integrated development environment
Visual Studio Code	0.3				1		Integrated development environment

Vulnerability Type	Criticality	U	C	H	M	L	Comment
Remote Code Execution	1.0		3	43	1		Remote Code Execution
Security Feature Bypass	0.9				1		Security Feature Bypass
Denial of Service	0.7			5	4		Denial of Service
Memory Corruption	0.6				18		Memory Corruption
Elevation of Privilege	0.5		1	2	51		Elevation of Privilege
Information Disclosure	0.4			1	12		Information Disclosure
Spoofing	0.4				4		Spoofing
Unknown Vulnerability Type	0		1			10	Unknown Vulnerability Type

Urgent (0)

Critical (5)

1. Elevation of Privilege - Windows Common Log File System Driver (CVE-2022-24521) - Critical [741]

Description: Windows Common Log File System Driver Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24481.

qualys: Microsoft Patch Tuesday Summary Microsoft has fixed 145 vulnerabilities, including 17 Microsoft Edge vulnerabilities, in the April 2022 update, with ten (10) classified as Critical as they allow Remote Code Execution (RCE). This month’s Patch Tuesday release includes fixes for two (2) zero-day vulnerabilities as well, one (1) known to be actively exploited (CVE-2022-24521) and the other to be publicly exposed (CVE-2022-26904). Microsoft has fixed several problems in their software, including Denial of Service, Elevation of Privilege, Information Disclosure, Remote Code Execution, and Spoofing vulnerabilities.

tenable: CVE-2022-24521 is an EoP vulnerability in the Windows Common Log File System (CLFS) driver for Microsoft Windows. EoP flaws like this one are leveraged post-authentication, after an attacker has successfully accessed a vulnerable system, to gain higher permissions. According to Microsoft, this flaw has been exploited in the wild as a zero-day, though we do not have any additional details about its exploitation. We do know that it was reported to Microsoft by the National Security Agency along with researchers at CrowdStrike. Organizations should ensure they apply the available patches as soon as possible. CVE-2022-24481 is another EoP in the CLFS driver that received the same CVSSv3 score of 7.8 and was rated “Exploitation More Likely” according to Microsoft’s Exploitability Index. However, it is not a zero-day.

rapid7: One of these has been observed being exploited in the wild: CVE-2022-24521, reported to Microsoft by the National Security Agency, affects the Common Log File System Driver in all supported versions of Windows and allows attackers to gain additional privileges on a system they already have local access to. Another local privilege escalation (LPE), CVE-2022-26904 affecting the Windows User Profile Service, had been publicly disclosed but not reported as already being exploited – it’s harder for attackers to leverage as it relies on winning a race condition, which can be tricky to reliably achieve.

zdi: We should also call attention CVE-2022-24521, which is a bug in the Windows Common Log File System Driver and listed as under active attack. Since this vulnerability only allows a privilege escalation, it is likely paired with a separate code execution bug. We should also point out that this was reported by the National Security Agency. It’s not stated how widely the exploit is being used in the wild, but it’s likely still targeted at this point and not broadly available. Go patch your systems before that situation changes.

kaspersky: According to the information available at this moment, CVE-2022-24521 seems to be the most dangerous of the bunch. It is a vulnerability in the Windows Common Log File System (CLFS) driver and is associated with privilege elevation. Despite a not-so-impressive CVSS:3.1 rating (7.8), it’s fairly easy to exploit. Which, in fact, some unknown attackers are already doing.

krebsonsecurity: Of particular concern this month is CVE-2022-24521, which is a “privilege escalation” vulnerability in the Windows common log file system driver. In its advisory, Microsoft said it received a report from the NSA that the flaw is under active attack.

computerweekly: The vulnerabilities in question are CVE-2022-24521, an elevation of privilege vulnerability in the Windows Common Log File System Driver, which is exploited but not public; and CVE-2022-26904, an elevation of privilege vulnerability in the Windows User Profile Service, which is public but not exploited. Both vulnerabilities carry CVSS scores of between seven and eight, rated as important.

thehackersnews: The actively exploited flaw (CVE-2022-24521, CVSS score: 7.8) relates to an elevation of privilege vulnerability in the Windows Common Log File System (CLFS). Credited with reporting the flaw are the U.S. National Security Agency (NSA) and CrowdStrike researchers Adam Podlosky and Amir Bazine.

threatpost: The vulnerability that’s been exploited in the wild ahead of patching allows privilege escalation, and is tracked as CVE-2022-24521. It rates 7.8 out of 10 on the CVSS vulnerability-severity scale. It’s listed as a “Windows Common Log File System Driver Execution Vulnerability,” and was reported to Microsoft by the National Security Agency.

2. Remote Code Execution - Remote Procedure Call Runtime (CVE-2022-26809) - Critical [737]

Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24492, CVE-2022-24528.

qualys: CVE-2022-26809 | Remote Procedure Call (RPC) Runtime Remote Code Execution (RCE) Vulnerability This vulnerability has a CVSSv3.1 score of 9.8/10. To exploit this vulnerability, an attacker would need to send a specially crafted Remote Procedure Call (RPC) to an RPC host. This could result in remote code execution (RCE) on the server-side with the same permissions as the RPC service. Microsoft offers mitigations for this vulnerability; Block TCP port 445 at the enterprise perimeter firewall, and follow Microsoft guidelines to secure SMB traffic. Exploitability Assessment: Exploitation More Likely.

tenable: Update April 20: The section for CVE-2022-26809 has been updated to reflect new guidance from Microsoft.

tenable: CVE-2022-26809 is a critical RCE vulnerability in the Remote Procedure Call (RPC) runtime. It received a CVSSv3 score of 9.8. An unauthenticated, remote attacker could exploit this vulnerability by sending “a specially crafted RPC call to an RPC host.”

rapid7: LPEs don’t always get the same attention that remote code execution (RCE) vulnerabilities do, but they can be a great help to attackers after they gain an initial foothold. These two categories dominate this month’s vulnerabilities, with 55 LPEs and 47 RCEs getting patched. 10 of the RCEs are considered “Critical,” affecting Windows Hyper-V (CVE-2022-22008, CVE-2022-23257, CVE-2022-24537); Windows SMB Client (CVE-2022-24500, CVE-2022-24541); Windows Network File System (CVE-2022-24491 and CVE-2022-24497); LDAP (CVE-2022-26919); Microsoft Dynamics (CVE-2022-23259); and the Windows RPC Runtime (CVE-2022-26809).

zdi: CVE-2022-26809 - RPC Runtime Library Remote Code Execution Vulnerability. This bug is rated as a CVSS 9.8, and the exploit index notes exploitation is more likely. The vulnerability could allow a remote attacker to executed code at high privileges on an affected system. Since no user interaction is required, these factors combine to make this wormable, at least between machine where RPC can be reached. However, the static port used here (TCP port 135) is typically blocked at the network perimeter. Still, this bug could be used for lateral movement by an attacker. Definitely test and deploy this one quickly.

kaspersky: All critical-level vulnerabilities in Windows the big update addresses are related to remote code execution (RCE). Of these, CVE-2022-26809 in the Windows Remote Procedure Call Runtime Library, as well as CVE-2022-24491 and CVE-2022-24497 in the Network File Access Protocol, have the highest severity rating — 9.8 points.

krebsonsecurity: Among the scariest critical bugs is CVE-2022-26809, a potentially “wormable” weakness in a core Windows component (RPC) that earned a CVSS score of 9.8 (10 being the worst). Microsoft said it believes exploitation of this flaw is more likely than not.

thehackersnews: Other critical flaws to note include a number of remote code execution flaws in RPC Runtime Library (CVE-2022-26809, CVSS score: 9.8), Windows Network File System (CVE-2022-24491 and CVE-2022-24497, CVSS scores: 9.8), Windows Server Service (CVE-2022-24541), Windows SMB (CVE-2022-24500), and Microsoft Dynamics 365 (CVE-2022-23259).

threatpost: Out of the critical flaws, all of which allow remote code-execution (RCE), researchers flagged a bug that could allow for self-propagating exploits (CVE-2022-26809) as being of the most concern.

3. Remote Code Execution - Remote Procedure Call Runtime (CVE-2022-24492) - Critical [724]

Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24528, CVE-2022-26809.

4. Remote Code Execution - Remote Procedure Call Runtime (CVE-2022-24528) - Critical [724]

Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24492, CVE-2022-26809.

5. Unknown Vulnerability Type - Microsoft Edge (CVE-2022-1096) - Critical [624]

Description: {'ms_cve_data_all': 'Chromium: CVE-2022-1096 Type Confusion in V8. This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.\nGoogle is aware that an exploit for CVE-2022-1096 exists in the wild.\n', 'nvd_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.', 'combined_cve_data_all': ''}

MS PT Extended: CVE-2022-1096 was published before April 2022 Patch Tuesday from 2022-03-09 to 2022-04-11

High (51)

6. Elevation of Privilege - Windows User Profile Service (CVE-2022-26904) - High [577]

Description: Windows User Profile Service Elevation of Privilege Vulnerability.

qualys: Microsoft Patch Tuesday Summary Microsoft has fixed 145 vulnerabilities, including 17 Microsoft Edge vulnerabilities, in the April 2022 update, with ten (10) classified as Critical as they allow Remote Code Execution (RCE). This month’s Patch Tuesday release includes fixes for two (2) zero-day vulnerabilities as well, one (1) known to be actively exploited (CVE-2022-24521) and the other to be publicly exposed (CVE-2022-26904). Microsoft has fixed several problems in their software, including Denial of Service, Elevation of Privilege, Information Disclosure, Remote Code Execution, and Spoofing vulnerabilities.

tenable: CVE-2022-26904 is an EoP vulnerability in the Windows User Profile service. It received a CVSSv3 score of 7.0, which rates its severity as important. The attack complexity for this flaw is considered high because it “requires an attacker to win a race condition.” Despite the higher complexity, it is still considered as “Exploitation More Likely.” This is the second of two zero-days addressed this month, as details about this vulnerability were publicly disclosed prior to a patch being made available.

rapid7: One of these has been observed being exploited in the wild: CVE-2022-24521, reported to Microsoft by the National Security Agency, affects the Common Log File System Driver in all supported versions of Windows and allows attackers to gain additional privileges on a system they already have local access to. Another local privilege escalation (LPE), CVE-2022-26904 affecting the Windows User Profile Service, had been publicly disclosed but not reported as already being exploited – it’s harder for attackers to leverage as it relies on winning a race condition, which can be tricky to reliably achieve.

zdi: CVE-2022-26904 - Windows User Profile Service Elevation of Privilege Vulnerability. This is one of the publicly known bugs patched this month, and not only is PoC out there for it, there’s a Metasploit module as well. This privilege escalation vulnerability allows an attacker to gain code execution at SYSTEM level on affected systems. They would, of course, need some level privileges before they could escalate. That’s why these types of bugs are often paired with code execution bugs like the ones in Adobe Reader (mentioned above) to completely take over a system.

kaspersky: CVE-2022-26904, another privilege elevation vulnerability, resides in the Windows User Profiles system service. It also has a relatively low rating on the CVSS:3.1 scale (7.0). However, this vulnerability was also known before the update was released, therefore it is logical to assume that potential attackers could start exploiting it faster than the others.

computerweekly: The vulnerabilities in question are CVE-2022-24521, an elevation of privilege vulnerability in the Windows Common Log File System Driver, which is exploited but not public; and CVE-2022-26904, an elevation of privilege vulnerability in the Windows User Profile Service, which is public but not exploited. Both vulnerabilities carry CVSS scores of between seven and eight, rated as important.

computerweekly: As noted above, CVE-2022-26904 is of particular interest this month as it was supposed to have been fixed in the August 2021 update, when it was tracked as CVE-2021-34484. However, the researcher who discovered it later discovered a bypass, and then when that was fixed again in January, he went and bypassed it a second time. It is known to be tricky to exploit as it requires a malicious actor to perfectly time their attack to win what is known as a “race condition”.

thehackersnews: The second publicly-known zero-day flaw (CVE-2022-26904, CVSS score: 7.0) also concerns a case of privilege escalation in the Windows User Profile Service, successful exploitation of which "requires an attacker to win a race condition."

threatpost: The second zero-day is found in the Windows User Profile Service, and is tracked as CVE-2022-26904.

7. Information Disclosure - Windows Kernel (CVE-2022-24483) - High [562]

Description: Windows Kernel Information Disclosure Vulnerability.

8. Remote Code Execution - Windows DNS Server (CVE-2022-26812) - High [559]

Description: Windows DNS Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24536, CVE-2022-26811, CVE-2022-26813, CVE-2022-26814, CVE-2022-26815, CVE-2022-26817, CVE-2022-26818, CVE-2022-26819, CVE-2022-26820, CVE-2022-26821, CVE-2022-26822, CVE-2022-26823, CVE-2022-26824, CVE-2022-26825, CVE-2022-26826, CVE-2022-26829.

9. Remote Code Execution - Windows DNS Server (CVE-2022-26814) - High [559]

Description: Windows DNS Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24536, CVE-2022-26811, CVE-2022-26812, CVE-2022-26813, CVE-2022-26815, CVE-2022-26817, CVE-2022-26818, CVE-2022-26819, CVE-2022-26820, CVE-2022-26821, CVE-2022-26822, CVE-2022-26823, CVE-2022-26824, CVE-2022-26825, CVE-2022-26826, CVE-2022-26829.

tenable: CVE-2022-26817 and CVE-2022-26814 are RCE vulnerabilities in Windows DNS Server affecting Active Directory Domain Services that both received a CVSSv3 score of 6.6 and were discovered by Yuki Chen with Cyber KunLun. Exploitation of this vulnerability is rated “Less Likely” which may be tied to the higher attack complexity and required permissions. To successfully exploit this flaw, an attacker on the target network with permissions to query the domain name service must win a race condition. Only if they perfectly time exploitation of this vulnerability, can they achieve RCE. Patches have been released for supported versions for Windows Server and Windows Server Core installations.

10. Remote Code Execution - Windows DNS Server (CVE-2022-26829) - High [559]

Description: Windows DNS Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24536, CVE-2022-26811, CVE-2022-26812, CVE-2022-26813, CVE-2022-26814, CVE-2022-26815, CVE-2022-26817, CVE-2022-26818, CVE-2022-26819, CVE-2022-26820, CVE-2022-26821, CVE-2022-26822, CVE-2022-26823, CVE-2022-26824, CVE-2022-26825, CVE-2022-26826.

11. Remote Code Execution - Windows SMB (CVE-2022-24500) - High [513]

Description: Windows SMB Remote Code Execution Vulnerability.

qualys: CVE-2022-24500 | Windows SMB Remote Code Execution (RCE) Vulnerability This vulnerability has a CVSSv3.1 score of 8.8/10. This vulnerability requires that a user with an affected version of Windows access a malicious server. An attacker would have to host a specially crafted server share or website. An attacker would have no way to force users to visit this specially crafted server share or website, but would have to convince them to visit the server share or website, typically by way of an enticement in an email or chat message. For vulnerability to be exploited, a user would need to access a malicious SMB server to retrieve some data as part of an OS API call. Microsoft offers mitigations for this vulnerability; Block TCP port 445 at the enterprise perimeter firewall, and follow Microsoft guidelines to secure SMB traffic. Exploitability Assessment: Exploitation Less Likely.

rapid7: LPEs don’t always get the same attention that remote code execution (RCE) vulnerabilities do, but they can be a great help to attackers after they gain an initial foothold. These two categories dominate this month’s vulnerabilities, with 55 LPEs and 47 RCEs getting patched. 10 of the RCEs are considered “Critical,” affecting Windows Hyper-V (CVE-2022-22008, CVE-2022-23257, CVE-2022-24537); Windows SMB Client (CVE-2022-24500, CVE-2022-24541); Windows Network File System (CVE-2022-24491 and CVE-2022-24497); LDAP (CVE-2022-26919); Microsoft Dynamics (CVE-2022-23259); and the Windows RPC Runtime (CVE-2022-26809).

krebsonsecurity: Speaking of wormable flaws, CVE-2022-24500 is a critical bug in the Windows Server Message Block (SMB).

thehackersnews: Other critical flaws to note include a number of remote code execution flaws in RPC Runtime Library (CVE-2022-26809, CVSS score: 9.8), Windows Network File System (CVE-2022-24491 and CVE-2022-24497, CVSS scores: 9.8), Windows Server Service (CVE-2022-24541), Windows SMB (CVE-2022-24500), and Microsoft Dynamics 365 (CVE-2022-23259).

threatpost: - CVE-2022-24500: Windows SMB (CVSS 8.8)

12. Remote Code Execution - Kerberos (CVE-2022-24545) - High [500]

Description: Windows Kerberos Remote Code Execution Vulnerability.

13. Remote Code Execution - Windows Kernel (CVE-2022-24541) - High [494]

Description: Windows Server Service Remote Code Execution Vulnerability.

qualys: CVE-2022-24541 | Windows Server Service Remote Code Execution (RCE) Vulnerability This vulnerability has a CVSSv3.1 score of 8.8/10. This vulnerability requires that a user with an affected version of Windows access a malicious server. An attacker would have to host a specially crafted server share or website. An attacker would have no way to force users to visit this specially crafted server share or website, but would have to convince them to visit the server share or website, typically by way of an enticement in an email or chat message. Microsoft offers mitigations for this vulnerability; Block TCP port 445 at the enterprise perimeter firewall, and follow Microsoft guidelines to secure SMB traffic. Exploitability Assessment: Exploitation Less Likely.

rapid7: LPEs don’t always get the same attention that remote code execution (RCE) vulnerabilities do, but they can be a great help to attackers after they gain an initial foothold. These two categories dominate this month’s vulnerabilities, with 55 LPEs and 47 RCEs getting patched. 10 of the RCEs are considered “Critical,” affecting Windows Hyper-V (CVE-2022-22008, CVE-2022-23257, CVE-2022-24537); Windows SMB Client (CVE-2022-24500, CVE-2022-24541); Windows Network File System (CVE-2022-24491 and CVE-2022-24497); LDAP (CVE-2022-26919); Microsoft Dynamics (CVE-2022-23259); and the Windows RPC Runtime (CVE-2022-26809).

thehackersnews: Other critical flaws to note include a number of remote code execution flaws in RPC Runtime Library (CVE-2022-26809, CVSS score: 9.8), Windows Network File System (CVE-2022-24491 and CVE-2022-24497, CVSS scores: 9.8), Windows Server Service (CVE-2022-24541), Windows SMB (CVE-2022-24500), and Microsoft Dynamics 365 (CVE-2022-23259).

threatpost: - CVE-2022-24541: Windows Server (CVSS 8.8)

14. Remote Code Execution - Windows Network File System (CVE-2022-24491) - High [489]

Description: Windows Network File System Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24497.

qualys: CVE-2022-24491 and CVE-2022-24497 | Windows Network File System Remote Code Execution (RCE) Vulnerability This vulnerability has a CVSSv3.1 score of 9.8/10. An attacker could send a specially crafted NFS protocol network message to a vulnerable Windows machine, which could enable remote code execution. NOTE: This vulnerability is only exploitable for systems that have the NFS role enabled. Exploitability Assessment: Exploitation More Likely.

tenable: CVE-2022-24491 is a critical RCE vulnerability in the Windows Network File System (NFS) that received a CVSSv3 score of 9.8 and a rating of “Exploitation More Likely.” An unauthenticated, remote attacker could exploit this vulnerability by sending specially crafted NFS protocol network messages to a vulnerable system. Only systems with the NFS role enabled are at risk for exploitation; however, organizations should still apply the patch to all systems to ensure they are protected.

rapid7: LPEs don’t always get the same attention that remote code execution (RCE) vulnerabilities do, but they can be a great help to attackers after they gain an initial foothold. These two categories dominate this month’s vulnerabilities, with 55 LPEs and 47 RCEs getting patched. 10 of the RCEs are considered “Critical,” affecting Windows Hyper-V (CVE-2022-22008, CVE-2022-23257, CVE-2022-24537); Windows SMB Client (CVE-2022-24500, CVE-2022-24541); Windows Network File System (CVE-2022-24491 and CVE-2022-24497); LDAP (CVE-2022-26919); Microsoft Dynamics (CVE-2022-23259); and the Windows RPC Runtime (CVE-2022-26809).

zdi: CVE-2022-24491/24497 – Windows Network File System Remote Code Execution Vulnerability. Speaking of nearly wormable bugs, these two NFS vulnerabilities also rate a 9.8 CVSS and are listed as exploitation more likely. On systems where the NFS role is enabled, a remote attacker could execute their code on an affected system with high privileges and without user interaction. Again, that adds up to a wormable bug – at least between NFS servers. Similar to RPC, this is often blocked at the network perimeter. However, Microsoft does provide guidance on how the RPC port multiplexer (port 2049) “is firewall-friendly and simplifies deployment of NFS.” Check your installations and roll out these patches rapidly.

kaspersky: All critical-level vulnerabilities in Windows the big update addresses are related to remote code execution (RCE). Of these, CVE-2022-26809 in the Windows Remote Procedure Call Runtime Library, as well as CVE-2022-24491 and CVE-2022-24497 in the Network File Access Protocol, have the highest severity rating — 9.8 points.

krebsonsecurity: Other potentially wormable threats this month include CVE-2022-24491 and CVE-2022-24497, Windows Network File System (NFS) vulnerabilities that also clock in at 9.8 CVSS scores and are listed as “exploitation more likely by Microsoft.”

thehackersnews: Other critical flaws to note include a number of remote code execution flaws in RPC Runtime Library (CVE-2022-26809, CVSS score: 9.8), Windows Network File System (CVE-2022-24491 and CVE-2022-24497, CVSS scores: 9.8), Windows Server Service (CVE-2022-24541), Windows SMB (CVE-2022-24500), and Microsoft Dynamics 365 (CVE-2022-23259).

threatpost: Next up are CVE-2022-24491/24497, two RCE bugs that affect the Windows Network File System (NFS). Both also have CVSS scores of 9.8, and both are listed as exploitation more likely. They also allow the potential for worming exploits, Childs warned.

15. Remote Code Execution - Windows Network File System (CVE-2022-24497) - High [489]

Description: Windows Network File System Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24491.

MS PT Extended: CVE-2022-24497 was published before April 2022 Patch Tuesday from 2022-03-09 to 2022-04-11

qualys: CVE-2022-24491 and CVE-2022-24497 | Windows Network File System Remote Code Execution (RCE) Vulnerability This vulnerability has a CVSSv3.1 score of 9.8/10. An attacker could send a specially crafted NFS protocol network message to a vulnerable Windows machine, which could enable remote code execution. NOTE: This vulnerability is only exploitable for systems that have the NFS role enabled. Exploitability Assessment: Exploitation More Likely.

rapid7: LPEs don’t always get the same attention that remote code execution (RCE) vulnerabilities do, but they can be a great help to attackers after they gain an initial foothold. These two categories dominate this month’s vulnerabilities, with 55 LPEs and 47 RCEs getting patched. 10 of the RCEs are considered “Critical,” affecting Windows Hyper-V (CVE-2022-22008, CVE-2022-23257, CVE-2022-24537); Windows SMB Client (CVE-2022-24500, CVE-2022-24541); Windows Network File System (CVE-2022-24491 and CVE-2022-24497); LDAP (CVE-2022-26919); Microsoft Dynamics (CVE-2022-23259); and the Windows RPC Runtime (CVE-2022-26809).

kaspersky: All critical-level vulnerabilities in Windows the big update addresses are related to remote code execution (RCE). Of these, CVE-2022-26809 in the Windows Remote Procedure Call Runtime Library, as well as CVE-2022-24491 and CVE-2022-24497 in the Network File Access Protocol, have the highest severity rating — 9.8 points.

krebsonsecurity: Other potentially wormable threats this month include CVE-2022-24491 and CVE-2022-24497, Windows Network File System (NFS) vulnerabilities that also clock in at 9.8 CVSS scores and are listed as “exploitation more likely by Microsoft.”

thehackersnews: Other critical flaws to note include a number of remote code execution flaws in RPC Runtime Library (CVE-2022-26809, CVSS score: 9.8), Windows Network File System (CVE-2022-24491 and CVE-2022-24497, CVSS scores: 9.8), Windows Server Service (CVE-2022-24541), Windows SMB (CVE-2022-24500), and Microsoft Dynamics 365 (CVE-2022-23259).

16. Remote Code Execution - Windows Kernel (CVE-2022-24543) - High [481]

Description: Windows Upgrade Assistant Remote Code Execution Vulnerability.

17. Remote Code Execution - Windows Kernel (CVE-2022-26919) - High [481]

Description: Windows LDAP Remote Code Execution Vulnerability.

rapid7: LPEs don’t always get the same attention that remote code execution (RCE) vulnerabilities do, but they can be a great help to attackers after they gain an initial foothold. These two categories dominate this month’s vulnerabilities, with 55 LPEs and 47 RCEs getting patched. 10 of the RCEs are considered “Critical,” affecting Windows Hyper-V (CVE-2022-22008, CVE-2022-23257, CVE-2022-24537); Windows SMB Client (CVE-2022-24500, CVE-2022-24541); Windows Network File System (CVE-2022-24491 and CVE-2022-24497); LDAP (CVE-2022-26919); Microsoft Dynamics (CVE-2022-23259); and the Windows RPC Runtime (CVE-2022-26809).

threatpost: - CVE-2022-26919: Windows LDAP (CVSS 8.1)

18. Remote Code Execution - Microsoft Local Security Authority Server (CVE-2022-24487) - High [475]

Description: Windows Local Security Authority (LSA) Remote Code Execution Vulnerability.

19. Elevation of Privilege - Windows Win32k (CVE-2022-26914) - High [471]

Description: Win32k Elevation of Privilege Vulnerability.

20. Remote Code Execution - Windows DNS Server (CVE-2022-24536) - High [467]

Description: Windows DNS Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-26811, CVE-2022-26812, CVE-2022-26813, CVE-2022-26814, CVE-2022-26815, CVE-2022-26817, CVE-2022-26818, CVE-2022-26819, CVE-2022-26820, CVE-2022-26821, CVE-2022-26822, CVE-2022-26823, CVE-2022-26824, CVE-2022-26825, CVE-2022-26826, CVE-2022-26829.

21. Remote Code Execution - Windows DNS Server (CVE-2022-26811) - High [467]

Description: Windows DNS Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24536, CVE-2022-26812, CVE-2022-26813, CVE-2022-26814, CVE-2022-26815, CVE-2022-26817, CVE-2022-26818, CVE-2022-26819, CVE-2022-26820, CVE-2022-26821, CVE-2022-26822, CVE-2022-26823, CVE-2022-26824, CVE-2022-26825, CVE-2022-26826, CVE-2022-26829.

22. Remote Code Execution - Windows DNS Server (CVE-2022-26813) - High [467]

Description: Windows DNS Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24536, CVE-2022-26811, CVE-2022-26812, CVE-2022-26814, CVE-2022-26815, CVE-2022-26817, CVE-2022-26818, CVE-2022-26819, CVE-2022-26820, CVE-2022-26821, CVE-2022-26822, CVE-2022-26823, CVE-2022-26824, CVE-2022-26825, CVE-2022-26826, CVE-2022-26829.

23. Remote Code Execution - Windows DNS Server (CVE-2022-26815) - High [467]

Description: Windows DNS Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24536, CVE-2022-26811, CVE-2022-26812, CVE-2022-26813, CVE-2022-26814, CVE-2022-26817, CVE-2022-26818, CVE-2022-26819, CVE-2022-26820, CVE-2022-26821, CVE-2022-26822, CVE-2022-26823, CVE-2022-26824, CVE-2022-26825, CVE-2022-26826, CVE-2022-26829.

zdi: CVE-2022-26815 - Windows DNS Server Remote Code Execution Vulnerability. This vulnerability is the most severe of the 18(!) DNS Server bugs receiving patches this month. This bug is also very similar to one patched back in February, which makes one wonder if this bug is the result of a failed patch. There are a couple of important mitigations to point out here. The first is that dynamic updates must be enabled for a server to be affected by this bug. The CVSS also lists some level of privileges to exploit. Still, any chance of an attacker getting RCE on a DNS server is one too many, so get your DNS servers patched.

threatpost: Also worth mentioning: Out of a whopping 18 bugs found in the Windows Domain Name Server (DNS), one (CVE-2022-26815) allows RCE and is listed as important, with a CVSS score of 7.2.

24. Remote Code Execution - Windows DNS Server (CVE-2022-26817) - High [467]

Description: Windows DNS Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24536, CVE-2022-26811, CVE-2022-26812, CVE-2022-26813, CVE-2022-26814, CVE-2022-26815, CVE-2022-26818, CVE-2022-26819, CVE-2022-26820, CVE-2022-26821, CVE-2022-26822, CVE-2022-26823, CVE-2022-26824, CVE-2022-26825, CVE-2022-26826, CVE-2022-26829.

tenable: CVE-2022-26817 and CVE-2022-26814 are RCE vulnerabilities in Windows DNS Server affecting Active Directory Domain Services that both received a CVSSv3 score of 6.6 and were discovered by Yuki Chen with Cyber KunLun. Exploitation of this vulnerability is rated “Less Likely” which may be tied to the higher attack complexity and required permissions. To successfully exploit this flaw, an attacker on the target network with permissions to query the domain name service must win a race condition. Only if they perfectly time exploitation of this vulnerability, can they achieve RCE. Patches have been released for supported versions for Windows Server and Windows Server Core installations.

25. Remote Code Execution - Windows DNS Server (CVE-2022-26818) - High [467]

Description: Windows DNS Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24536, CVE-2022-26811, CVE-2022-26812, CVE-2022-26813, CVE-2022-26814, CVE-2022-26815, CVE-2022-26817, CVE-2022-26819, CVE-2022-26820, CVE-2022-26821, CVE-2022-26822, CVE-2022-26823, CVE-2022-26824, CVE-2022-26825, CVE-2022-26826, CVE-2022-26829.

26. Remote Code Execution - Windows DNS Server (CVE-2022-26819) - High [467]

Description: Windows DNS Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24536, CVE-2022-26811, CVE-2022-26812, CVE-2022-26813, CVE-2022-26814, CVE-2022-26815, CVE-2022-26817, CVE-2022-26818, CVE-2022-26820, CVE-2022-26821, CVE-2022-26822, CVE-2022-26823, CVE-2022-26824, CVE-2022-26825, CVE-2022-26826, CVE-2022-26829.

27. Remote Code Execution - Windows DNS Server (CVE-2022-26820) - High [467]

Description: Windows DNS Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24536, CVE-2022-26811, CVE-2022-26812, CVE-2022-26813, CVE-2022-26814, CVE-2022-26815, CVE-2022-26817, CVE-2022-26818, CVE-2022-26819, CVE-2022-26821, CVE-2022-26822, CVE-2022-26823, CVE-2022-26824, CVE-2022-26825, CVE-2022-26826, CVE-2022-26829.

28. Remote Code Execution - Windows DNS Server (CVE-2022-26821) - High [467]

Description: Windows DNS Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24536, CVE-2022-26811, CVE-2022-26812, CVE-2022-26813, CVE-2022-26814, CVE-2022-26815, CVE-2022-26817, CVE-2022-26818, CVE-2022-26819, CVE-2022-26820, CVE-2022-26822, CVE-2022-26823, CVE-2022-26824, CVE-2022-26825, CVE-2022-26826, CVE-2022-26829.

29. Remote Code Execution - Windows DNS Server (CVE-2022-26822) - High [467]

Description: Windows DNS Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24536, CVE-2022-26811, CVE-2022-26812, CVE-2022-26813, CVE-2022-26814, CVE-2022-26815, CVE-2022-26817, CVE-2022-26818, CVE-2022-26819, CVE-2022-26820, CVE-2022-26821, CVE-2022-26823, CVE-2022-26824, CVE-2022-26825, CVE-2022-26826, CVE-2022-26829.

30. Remote Code Execution - Windows DNS Server (CVE-2022-26823) - High [467]

Description: Windows DNS Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24536, CVE-2022-26811, CVE-2022-26812, CVE-2022-26813, CVE-2022-26814, CVE-2022-26815, CVE-2022-26817, CVE-2022-26818, CVE-2022-26819, CVE-2022-26820, CVE-2022-26821, CVE-2022-26822, CVE-2022-26824, CVE-2022-26825, CVE-2022-26826, CVE-2022-26829.

31. Remote Code Execution - Windows DNS Server (CVE-2022-26824) - High [467]

Description: Windows DNS Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24536, CVE-2022-26811, CVE-2022-26812, CVE-2022-26813, CVE-2022-26814, CVE-2022-26815, CVE-2022-26817, CVE-2022-26818, CVE-2022-26819, CVE-2022-26820, CVE-2022-26821, CVE-2022-26822, CVE-2022-26823, CVE-2022-26825, CVE-2022-26826, CVE-2022-26829.

32. Remote Code Execution - Windows DNS Server (CVE-2022-26825) - High [467]

Description: Windows DNS Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24536, CVE-2022-26811, CVE-2022-26812, CVE-2022-26813, CVE-2022-26814, CVE-2022-26815, CVE-2022-26817, CVE-2022-26818, CVE-2022-26819, CVE-2022-26820, CVE-2022-26821, CVE-2022-26822, CVE-2022-26823, CVE-2022-26824, CVE-2022-26826, CVE-2022-26829.

33. Remote Code Execution - Windows DNS Server (CVE-2022-26826) - High [467]

Description: Windows DNS Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24536, CVE-2022-26811, CVE-2022-26812, CVE-2022-26813, CVE-2022-26814, CVE-2022-26815, CVE-2022-26817, CVE-2022-26818, CVE-2022-26819, CVE-2022-26820, CVE-2022-26821, CVE-2022-26822, CVE-2022-26823, CVE-2022-26824, CVE-2022-26825, CVE-2022-26829.

34. Remote Code Execution - Windows Kernel (CVE-2022-24495) - High [467]

Description: Windows Direct Show - Remote Code Execution Vulnerability.

35. Remote Code Execution - DiskUsage.exe (CVE-2022-26830) - High [462]

Description: DiskUsage.exe Remote Code Execution Vulnerability.

36. Remote Code Execution - Win32 File Enumeration (CVE-2022-24485) - High [462]

Description: Win32 File Enumeration Remote Code Execution Vulnerability.

37. Remote Code Execution - Win32 Stream Enumeration (CVE-2022-21983) - High [462]

Description: Win32 Stream Enumeration Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24534.

38. Remote Code Execution - Win32 Stream Enumeration (CVE-2022-24534) - High [462]

Description: Win32 Stream Enumeration Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21983.

39. Remote Code Execution - Windows Graphics Component (CVE-2022-26903) - High [462]

Description: Windows Graphics Component Remote Code Execution Vulnerability.

40. Remote Code Execution - Windows Remote Desktop Protocol (CVE-2022-24533) - High [462]

Description: Remote Desktop Protocol Remote Code Execution Vulnerability.

41. Remote Code Execution - HEVC Video Extensions (CVE-2022-24532) - High [443]

Description: HEVC Video Extensions Remote Code Execution Vulnerability.

42. Remote Code Execution - Windows Fax Compose Form (CVE-2022-26916) - High [443]

Description: Windows Fax Compose Form Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-26917, CVE-2022-26918.

43. Remote Code Execution - Windows Fax Compose Form (CVE-2022-26917) - High [443]

Description: Windows Fax Compose Form Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-26916, CVE-2022-26918.

44. Remote Code Execution - Windows Fax Compose Form (CVE-2022-26918) - High [443]

Description: Windows Fax Compose Form Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-26916, CVE-2022-26917.

45. Remote Code Execution - Windows Hyper-V (CVE-2022-23257) - High [437]

Description: Windows Hyper-V Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22008, CVE-2022-22009, CVE-2022-24537.

rapid7: LPEs don’t always get the same attention that remote code execution (RCE) vulnerabilities do, but they can be a great help to attackers after they gain an initial foothold. These two categories dominate this month’s vulnerabilities, with 55 LPEs and 47 RCEs getting patched. 10 of the RCEs are considered “Critical,” affecting Windows Hyper-V (CVE-2022-22008, CVE-2022-23257, CVE-2022-24537); Windows SMB Client (CVE-2022-24500, CVE-2022-24541); Windows Network File System (CVE-2022-24491 and CVE-2022-24497); LDAP (CVE-2022-26919); Microsoft Dynamics (CVE-2022-23259); and the Windows RPC Runtime (CVE-2022-26809).

threatpost: - CVE-2022-23257: Windows Hyper-V (CVSS 8.6)

46. Remote Code Execution - Microsoft Excel (CVE-2022-24473) - High [424]

Description: Microsoft Excel Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-26901.

rapid7: On the Office side of the house, Skype for Business Server was patched for spoofing (CVE-2022-26910) and information disclosure (CVE-2022-26911) vulnerabilities. Two RCEs affecting Excel (CVE-2022-24473 and CVE-2022-26901) were fixed, as well as a spoofing vulnerability in SharePoint Server (CVE-2022-24472).

47. Remote Code Execution - Microsoft Excel (CVE-2022-26901) - High [424]

Description: Microsoft Excel Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24473.

rapid7: On the Office side of the house, Skype for Business Server was patched for spoofing (CVE-2022-26910) and information disclosure (CVE-2022-26911) vulnerabilities. Two RCEs affecting Excel (CVE-2022-24473 and CVE-2022-26901) were fixed, as well as a spoofing vulnerability in SharePoint Server (CVE-2022-24472).

48. Remote Code Execution - Windows Hyper-V (CVE-2022-22008) - High [424]

Description: Windows Hyper-V Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22009, CVE-2022-23257, CVE-2022-24537.

rapid7: LPEs don’t always get the same attention that remote code execution (RCE) vulnerabilities do, but they can be a great help to attackers after they gain an initial foothold. These two categories dominate this month’s vulnerabilities, with 55 LPEs and 47 RCEs getting patched. 10 of the RCEs are considered “Critical,” affecting Windows Hyper-V (CVE-2022-22008, CVE-2022-23257, CVE-2022-24537); Windows SMB Client (CVE-2022-24500, CVE-2022-24541); Windows Network File System (CVE-2022-24491 and CVE-2022-24497); LDAP (CVE-2022-26919); Microsoft Dynamics (CVE-2022-23259); and the Windows RPC Runtime (CVE-2022-26809).

threatpost: - CVE-2022-22008: Windows Hyper-V (CVSS 7.7)

49. Remote Code Execution - Windows Hyper-V (CVE-2022-22009) - High [424]

Description: Windows Hyper-V Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22008, CVE-2022-23257, CVE-2022-24537.

50. Remote Code Execution - Windows Hyper-V (CVE-2022-24537) - High [424]

Description: Windows Hyper-V Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22008, CVE-2022-22009, CVE-2022-23257.

rapid7: LPEs don’t always get the same attention that remote code execution (RCE) vulnerabilities do, but they can be a great help to attackers after they gain an initial foothold. These two categories dominate this month’s vulnerabilities, with 55 LPEs and 47 RCEs getting patched. 10 of the RCEs are considered “Critical,” affecting Windows Hyper-V (CVE-2022-22008, CVE-2022-23257, CVE-2022-24537); Windows SMB Client (CVE-2022-24500, CVE-2022-24541); Windows Network File System (CVE-2022-24491 and CVE-2022-24497); LDAP (CVE-2022-26919); Microsoft Dynamics (CVE-2022-23259); and the Windows RPC Runtime (CVE-2022-26809).

threatpost: - CVE-2022-24537: Windows Hyper-V (CVSS 7.7)

51. Denial of Service - Windows Kernel (CVE-2022-26831) - High [420]

Description: Windows LDAP Denial of Service Vulnerability.

52. Denial of Service - Windows Kernel (CVE-2022-26915) - High [420]

Description: Windows Secure Channel Denial of Service Vulnerability.

53. Remote Code Execution - Microsoft Dynamics 365 (CVE-2022-23259) - High [418]

Description: Microsoft Dynamics 365 (on-premises) Remote Code Execution Vulnerability.

qualys: CVE-2022-23259 | Microsoft Dynamics 365 (on-premises) Remote Code Execution (RCE) Vulnerability This vulnerability has a CVSSv3.1 score of 8.8/10. An authenticated user could run a specially crafted trusted solution package to execute arbitrary SQL commands. From there the attacker could escalate and execute commands as db_owner within their Dynamics 356 database. Exploitability Assessment: Exploitation Less Likely.

rapid7: LPEs don’t always get the same attention that remote code execution (RCE) vulnerabilities do, but they can be a great help to attackers after they gain an initial foothold. These two categories dominate this month’s vulnerabilities, with 55 LPEs and 47 RCEs getting patched. 10 of the RCEs are considered “Critical,” affecting Windows Hyper-V (CVE-2022-22008, CVE-2022-23257, CVE-2022-24537); Windows SMB Client (CVE-2022-24500, CVE-2022-24541); Windows Network File System (CVE-2022-24491 and CVE-2022-24497); LDAP (CVE-2022-26919); Microsoft Dynamics (CVE-2022-23259); and the Windows RPC Runtime (CVE-2022-26809).

thehackersnews: Other critical flaws to note include a number of remote code execution flaws in RPC Runtime Library (CVE-2022-26809, CVSS score: 9.8), Windows Network File System (CVE-2022-24491 and CVE-2022-24497, CVSS scores: 9.8), Windows Server Service (CVE-2022-24541), Windows SMB (CVE-2022-24500), and Microsoft Dynamics 365 (CVE-2022-23259).

threatpost: - CVE-2022-23259: Microsoft Dynamics 365 (on-premises) (CVSS 8.8)

54. Denial of Service - Windows Kernel (CVE-2022-24538) - High [406]

Description: Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-24484, CVE-2022-26784.

55. Denial of Service - Windows Kernel (CVE-2022-26784) - High [406]

Description: Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-24484, CVE-2022-24538.

56. Denial of Service - .NET Framework (CVE-2022-26832) - High [401]

Description: .NET Framework Denial of Service Vulnerability.

Medium (91)

57. Elevation of Privilege - Kerberos (CVE-2022-24486) - Medium [398]

Description: Windows Kerberos Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24544.

58. Elevation of Privilege - Kerberos (CVE-2022-24544) - Medium [398]

Description: Windows Kerberos Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24486.

59. Denial of Service - Windows Kernel (CVE-2022-24484) - Medium [393]

Description: Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-24538, CVE-2022-26784.

60. Elevation of Privilege - Windows Kernel (CVE-2022-24527) - Medium [379]

Description: Windows Endpoint Configuration Manager Elevation of Privilege Vulnerability.

rapid7: For any readers who enjoy deeper dives into vulnerabilities and exploits, Rapid7’s Jake Baines has a technical writeup of CVE-2022-24527, an LPE he discovered in the Connected Cache component of Microsoft Endpoint Manager that got fixed today. Check it out!. Summary charts

61. Elevation of Privilege - Windows Kernel (CVE-2022-24549) - Medium [379]

Description: Windows AppX Package Manager Elevation of Privilege Vulnerability.

62. Elevation of Privilege - Windows Kernel (CVE-2022-24550) - Medium [379]

Description: Windows Telephony Server Elevation of Privilege Vulnerability.

63. Elevation of Privilege - Windows Kernel (CVE-2022-26810) - Medium [379]

Description: Windows File Server Resource Management Service Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26827.

64. Elevation of Privilege - Windows Win32k (CVE-2022-24474) - Medium [379]

Description: Windows Win32k Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24542.

65. Elevation of Privilege - Windows Win32k (CVE-2022-24542) - Medium [379]

Description: Windows Win32k Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24474.

66. Denial of Service - Microsoft Defender (CVE-2022-24548) - Medium [374]

Description: Microsoft Defender Denial of Service Vulnerability.

67. Information Disclosure - .NET (CVE-2022-26907) - Medium [372]

Description: Azure SDK for .NET Information Disclosure Vulnerability.

68. Remote Code Execution - Azure (CVE-2022-26898) - Medium [372]

Description: Azure Site Recovery Remote Code Execution Vulnerability.

69. Elevation of Privilege - Windows Kernel (CVE-2022-24482) - Medium [366]

Description: Windows ALPC Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24540.

MS PT Extended: CVE-2022-24482 was published before April 2022 Patch Tuesday from 2022-03-09 to 2022-04-11

70. Elevation of Privilege - Windows Kernel (CVE-2022-24540) - Medium [366]

Description: Windows ALPC Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24482.

71. Elevation of Privilege - Windows Kernel (CVE-2022-26807) - Medium [366]

Description: Windows Work Folder Service Elevation of Privilege Vulnerability.

72. Elevation of Privilege - Windows Kernel (CVE-2022-26808) - Medium [366]

Description: Windows File Explorer Elevation of Privilege Vulnerability.

73. Elevation of Privilege - Windows Kernel (CVE-2022-26827) - Medium [366]

Description: Windows File Server Resource Management Service Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26810.

74. Elevation of Privilege - Cluster Client Failover (CVE-2022-24489) - Medium [360]

Description: Cluster Client Failover (CCF) Elevation of Privilege Vulnerability.

75. Elevation of Privilege - Connected User Experiences and Telemetry (CVE-2022-24479) - Medium [360]

Description: Connected User Experiences and Telemetry Elevation of Privilege Vulnerability.

76. Elevation of Privilege - Microsoft Edge (CVE-2022-24475) - Medium [360]

Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26891, CVE-2022-26894, CVE-2022-26895, CVE-2022-26900, CVE-2022-26908, CVE-2022-26909, CVE-2022-26912.

MS PT Extended: CVE-2022-24475 was published before April 2022 Patch Tuesday from 2022-03-09 to 2022-04-11

77. Elevation of Privilege - Microsoft Edge (CVE-2022-26891) - Medium [360]

Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24475, CVE-2022-26894, CVE-2022-26895, CVE-2022-26900, CVE-2022-26908, CVE-2022-26909, CVE-2022-26912.

MS PT Extended: CVE-2022-26891 was published before April 2022 Patch Tuesday from 2022-03-09 to 2022-04-11

78. Elevation of Privilege - Microsoft Edge (CVE-2022-26894) - Medium [360]

Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24475, CVE-2022-26891, CVE-2022-26895, CVE-2022-26900, CVE-2022-26908, CVE-2022-26909, CVE-2022-26912.

MS PT Extended: CVE-2022-26894 was published before April 2022 Patch Tuesday from 2022-03-09 to 2022-04-11

79. Elevation of Privilege - Microsoft Edge (CVE-2022-26895) - Medium [360]

Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24475, CVE-2022-26891, CVE-2022-26894, CVE-2022-26900, CVE-2022-26908, CVE-2022-26909, CVE-2022-26912.

MS PT Extended: CVE-2022-26895 was published before April 2022 Patch Tuesday from 2022-03-09 to 2022-04-11

80. Elevation of Privilege - Microsoft Edge (CVE-2022-26900) - Medium [360]

Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24475, CVE-2022-26891, CVE-2022-26894, CVE-2022-26895, CVE-2022-26908, CVE-2022-26909, CVE-2022-26912.

MS PT Extended: CVE-2022-26900 was published before April 2022 Patch Tuesday from 2022-03-09 to 2022-04-11

81. Elevation of Privilege - Microsoft Edge (CVE-2022-26908) - Medium [360]

Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24475, CVE-2022-26891, CVE-2022-26894, CVE-2022-26895, CVE-2022-26900, CVE-2022-26909, CVE-2022-26912.

MS PT Extended: CVE-2022-26908 was published before April 2022 Patch Tuesday from 2022-03-09 to 2022-04-11

82. Elevation of Privilege - Microsoft Edge (CVE-2022-26909) - Medium [360]

Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24475, CVE-2022-26891, CVE-2022-26894, CVE-2022-26895, CVE-2022-26900, CVE-2022-26908, CVE-2022-26912.

MS PT Extended: CVE-2022-26909 was published before April 2022 Patch Tuesday from 2022-03-09 to 2022-04-11

83. Elevation of Privilege - Microsoft Edge (CVE-2022-26912) - Medium [360]

Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24475, CVE-2022-26891, CVE-2022-26894, CVE-2022-26895, CVE-2022-26900, CVE-2022-26908, CVE-2022-26909.

MS PT Extended: CVE-2022-26912 was published before April 2022 Patch Tuesday from 2022-03-09 to 2022-04-11

84. Elevation of Privilege - Microsoft Local Security Authority Server (CVE-2022-24496) - Medium [360]

Description: Local Security Authority (LSA) Elevation of Privilege Vulnerability.

85. Elevation of Privilege - Microsoft PowerShell (CVE-2022-26788) - Medium [360]

Description: PowerShell Elevation of Privilege Vulnerability.

86. Elevation of Privilege - Windows Ancillary Function Driver for WinSock (CVE-2022-24494) - Medium [360]

Description: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability.

87. Elevation of Privilege - Windows Common Log File System Driver (CVE-2022-24481) - Medium [360]

Description: Windows Common Log File System Driver Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24521.

tenable: CVE-2022-24521 is an EoP vulnerability in the Windows Common Log File System (CLFS) driver for Microsoft Windows. EoP flaws like this one are leveraged post-authentication, after an attacker has successfully accessed a vulnerable system, to gain higher permissions. According to Microsoft, this flaw has been exploited in the wild as a zero-day, though we do not have any additional details about its exploitation. We do know that it was reported to Microsoft by the National Security Agency along with researchers at CrowdStrike. Organizations should ensure they apply the available patches as soon as possible. CVE-2022-24481 is another EoP in the CLFS driver that received the same CVSSv3 score of 7.8 and was rated “Exploitation More Likely” according to Microsoft’s Exploitability Index. However, it is not a zero-day.

88. Elevation of Privilege - Windows DWM Core Library (CVE-2022-24546) - Medium [360]

Description: Windows DWM Core Library Elevation of Privilege Vulnerability.

89. Elevation of Privilege - Windows Installer (CVE-2022-24499) - Medium [360]

Description: Windows Installer Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24530.

90. Elevation of Privilege - Windows Installer (CVE-2022-24530) - Medium [360]

Description: Windows Installer Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24499.

91. Elevation of Privilege - Windows Print Spooler (CVE-2022-26786) - Medium [360]

Description: Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

92. Elevation of Privilege - Windows Print Spooler (CVE-2022-26787) - Medium [360]

Description: Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

93. Elevation of Privilege - Windows Print Spooler (CVE-2022-26789) - Medium [360]

Description: Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

94. Elevation of Privilege - Windows Print Spooler (CVE-2022-26790) - Medium [360]

Description: Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

95. Elevation of Privilege - Windows Print Spooler (CVE-2022-26791) - Medium [360]

Description: Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

96. Elevation of Privilege - Windows Print Spooler (CVE-2022-26792) - Medium [360]

Description: Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

97. Elevation of Privilege - Windows Print Spooler (CVE-2022-26793) - Medium [360]

Description: Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

98. Elevation of Privilege - Windows Print Spooler (CVE-2022-26794) - Medium [360]

Description: Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

99. Elevation of Privilege - Windows Print Spooler (CVE-2022-26795) - Medium [360]

Description: Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

100. Elevation of Privilege - Windows Print Spooler (CVE-2022-26796) - Medium [360]

Description: Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

101. Elevation of Privilege - Windows Print Spooler (CVE-2022-26797) - Medium [360]

Description: Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

102. Elevation of Privilege - Windows Print Spooler (CVE-2022-26798) - Medium [360]

Description: Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26801, CVE-2022-26802, CVE-2022-26803.

103. Elevation of Privilege - Windows Print Spooler (CVE-2022-26801) - Medium [360]

Description: Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26802, CVE-2022-26803.

104. Elevation of Privilege - Windows Print Spooler (CVE-2022-26802) - Medium [360]

Description: Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26803.

105. Elevation of Privilege - Windows Print Spooler (CVE-2022-26803) - Medium [360]

Description: Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26801, CVE-2022-26802.

106. Denial of Service - Windows Hyper-V (CVE-2022-23268) - Medium [350]

Description: Windows Hyper-V Denial of Service Vulnerability.

107. Elevation of Privilege - Windows Bluetooth Driver (CVE-2022-26828) - Medium [347]

Description: Windows Bluetooth Driver Elevation of Privilege Vulnerability.

108. Information Disclosure - Windows DNS Server (CVE-2022-26816) - Medium [345]

Description: Windows DNS Server Information Disclosure Vulnerability.

109. Information Disclosure - Windows Kernel (CVE-2022-24498) - Medium [345]

Description: Windows iSCSI Target Service Information Disclosure Vulnerability.

110. Denial of Service - YARP (CVE-2022-26924) - Medium [344]

Description: YARP Denial of Service Vulnerability.

111. Elevation of Privilege - Windows Desktop Bridge (CVE-2022-24488) - Medium [341]

Description: Windows Desktop Bridge Elevation of Privilege Vulnerability.

112. Elevation of Privilege - Microsoft Edge (CVE-2022-26899) - Medium [333]

Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

MS PT Extended: CVE-2022-26899 was published before April 2022 Patch Tuesday from 2022-03-09 to 2022-04-11

113. Spoofing - Microsoft SharePoint (CVE-2022-24472) - Medium [321]

Description: Microsoft SharePoint Server Spoofing Vulnerability.

rapid7: On the Office side of the house, Skype for Business Server was patched for spoofing (CVE-2022-26910) and information disclosure (CVE-2022-26911) vulnerabilities. Two RCEs affecting Excel (CVE-2022-24473 and CVE-2022-26901) were fixed, as well as a spoofing vulnerability in SharePoint Server (CVE-2022-24472).

114. Information Disclosure - Microsoft Local Security Authority Server (CVE-2022-24493) - Medium [313]

Description: Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability.

115. Information Disclosure - Windows Graphics Component (CVE-2022-26920) - Medium [313]

Description: Windows Graphics Component Information Disclosure Vulnerability.

116. Information Disclosure - Windows Hyper-V (CVE-2022-24490) - Medium [302]

Description: Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-24539, CVE-2022-26783, CVE-2022-26785.

117. Information Disclosure - Windows Hyper-V (CVE-2022-24539) - Medium [302]

Description: Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-24490, CVE-2022-26783, CVE-2022-26785.

118. Information Disclosure - Skype for Business (CVE-2022-26911) - Medium [289]

Description: Skype for Business Information Disclosure Vulnerability.

rapid7: On the Office side of the house, Skype for Business Server was patched for spoofing (CVE-2022-26910) and information disclosure (CVE-2022-26911) vulnerabilities. Two RCEs affecting Excel (CVE-2022-24473 and CVE-2022-26901) were fixed, as well as a spoofing vulnerability in SharePoint Server (CVE-2022-24472).

119. Information Disclosure - Windows Hyper-V (CVE-2022-26783) - Medium [289]

Description: Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-24490, CVE-2022-24539, CVE-2022-26785.

120. Information Disclosure - Windows Hyper-V (CVE-2022-26785) - Medium [289]

Description: Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability. This CVE ID is unique from CVE-2022-24490, CVE-2022-24539, CVE-2022-26783.

121. Spoofing - Microsoft Edge (CVE-2022-24523) - Medium [286]

Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability.

MS PT Extended: CVE-2022-24523 was published before April 2022 Patch Tuesday from 2022-03-09 to 2022-04-11

122. Elevation of Privilege - Git (CVE-2022-24547) - Medium [285]

Description: Windows Digital Media Receiver Elevation of Privilege Vulnerability.

123. Memory Corruption - Microsoft Edge (CVE-2022-0971) - Medium [272]

Description: Chromium: CVE-2022-0971 Use after free in Blink Layout. This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.