Microsoft has confirmed that the recently discovered Windows security exploit is already under attack
With 84 security issues requiring correction, Microsoft’s monthly Patch Tuesday rollout is upon us. While only four of these security vulnerabilities are classified by Microsoft as critical in nature, one stands out as requiring your most urgent attention.
What is CVE-2022-22047 Windows 0Day?
CVE-2022-22047 is, confirms Microsoft, already exploited by attackers. Microsoft describes this 0Day security threat as a Windows Client-Server Execution Subsystem (CSRSS) elevation of privilege vulnerability. Almost all versions of Windows are vulnerable to this threat, including Windows 7, 8.1, 10, 11, and Windows Server 2008, 2012, 2016, 2019, and 2022. Perhaps surprisingly, CVE-2022-22047 does not receive a rating critical. by Microsoft but an important one instead.
Is it a Windows critical vulnerability or not?
Not everyone agrees with this classification. “Windows CSRSS Elevation of Privilege, tracked as CVE-2022-22047, is critical because it is being actively exploited in the wild,” said Mike Walters, co-founder of cloud-based surveillance specialist Action1. “It has a CVSS score of 7.8 because it can only be run locally,” Walters continues, adding that “use of this vulnerability gives an attacker SYSTEM privileges.” While technical details are understandably scarce at this point, Walters warns that when combined with other attacks, it could give complete control of a Windows endpoint.
According to a Zero Day Initiative analysis of this latest Patch Tuesday security update, CVE-2022-22047 is precisely the type of vulnerability that is “commonly associated with a code execution bug, typically a specially crafted Office or Adobe document , to support a system.”
CISA orders federal agencies to patch
Another indicator of the severity of this 0Day exploit comes from the Cybersecurity & Infrastructure Security Agency (CISA). It just added CVE-2022-22047 to its catalog of known exploited vulnerabilities. This requires that federal agencies in the United States now have until August 2 to fix their systems. That doesn’t mean you’re off the hook if you’re not a federal agency yourself. CISA adds that it “strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing the timely remediation of catalog vulnerabilities as part of their vulnerability management practice.”
Comments are closed.