Latest Microsoft Patch Tuesday release is the smallest for some time, but still fixed some serious bugs
No “critical” flaws addressed in the new fix, but you should still update now
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
This month’sMicrosoftPatch Tuesday is out, and it’s leftWindowsadmins and cybersecurity experts alike scratching their heads a little.
As it turns out, this month’s fix comes with no more than 51 patches, making it one of the most lightweight fixes to come out of Microsoft in a long time - and to make matters even stranger, none of the patches were deemed “critical”.
That’s not to say that the patches shouldn’t still be applied, with a wide number of Microsoft software offerings affected.
No news is good news?
This month’s release addresses vulnerabilities in Windows and Windows Components, Azure Data Explorer, Kestrel Web Server, Microsoft Edge (Chromium-based), Windows Codecs Library, Microsoft Dynamics, Microsoft Dynamics GP, Microsoft Office and Office Components, Windows Hyper-V Server, SQL Server, Visual Studio Code, and Microsoft Teams.
What’s more, the company only addressed one zero-day vulnerability, a Windows Kernel elevation of privilege tracked under CVE-2022-21989.
Analyzing the patches, Zero Day Initiative’s Dustin Childs said: “It may have happened before, but I can’t find an example of a monthly release from Microsoft that doesn’t include at least one critical-rated patch.”
Immersive Labs director of cyber threat research, Kevin Breen, on the other hand, is under the impression that Windows admins shouldn’t lower their guard, something Childs essentially agrees with.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Microsoft issues official PrintNightmare fix in latest Patch Tuesday blast>You’ll want to install this Windows 11 update to speed up your PC>This Windows Server update is causing a bunch of problems
Discussing multiple CVEs listed in the fix withThe Register, Breen says they are all ”listed as elevation of privilege, which forms a key part of the attack chain. Once initial access has been gained, attackers will quickly seek to gain administrator-level access so they can move across the network, compromise other devices and avoid detection by disabling security tooling."
For CVE-2022-21984, Childs says “if you have this setup in your environment, an attacker could completely take over your DNS and execute code with elevated privileges. Since dynamic updates aren’t enabled by default, this doesn’t get a critical rating. However, if your DNS servers do use dynamic updates, you should treat this bug as critical.”
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
Lego will let you build Sir Ernest Shackleton’s iconic lost ship, the Endurance, in its next Icons set
