Microsoft Releases September 2022 Security Updates
Scheduled updates for Microsoft products
Summary
Scheduled updates for Microsoft products
Affected platforms
The following platforms are known to be affected:
The following platforms are also known to be affected:
- Azure Arc
- Cache Speculation
- HTTP.sys
- Microsoft Graphics Component
- Microsoft Windows ALPC
- Microsoft Windows Codecs Library
- Network Device Enrollment Service (NDES)
- Role: DNS Server
- Role: Windows Fax Service
- SPNEGO Extended Negotiation
- Visual Studio Code
- Windows Common Log File System Driver
- Windows Credential Roaming Service
- Windows Distributed File System (DFS)
- Windows DPAPI (Data Protection Application Programming Interface)
- Windows Enterprise App Management
- Windows Event Tracing
- Windows Group Policy
- Windows IKE Extension
- Windows Kerberos
- Windows Kernel
- Windows LDAP - Lightweight Directory Access Protocol
- Windows ODBC Driver
- Windows OLE
- Windows Photo Import API
- Windows Print Spooler Components
- Windows Remote Access Connection Manager
- Windows Remote Procedure Call
- Windows TCP/IP
- Windows Transport Security Layer (TLS)
Threat details
Introduction
Microsoft has released updates to address 63 vulnerabilities in Microsoft products, with 5 of them rated as critical. An unauthenticated, remote attacker could exploit some of these vulnerabilities to take control of an affected system.
Exploitation in the wild
Microsoft have reported exploitation of the Windows Common Log File System Driver privilege escalation vulnerability, known as CVE-2022-37969, and CISA have added it to their Known Exploited Vulnerabilities Catalog. Affected organisations are encouraged to read Microsoft's guidance for CVE-2022-37969 and apply any relevant updates.
In addition, Microsoft report that exploitation is more likely for CVE-2022-34718, a Windows TCP/IP remote code execution (RCE) vulnerability. NHS Digital has released high severity cyber alert CC-4165 and encourages organisations to read Microsoft guidance for CVE-2022-34718.
Remediation advice
Affected organisations are encouraged to review Microsoft’s September 2022 Security Update Summary and Deployment Information and apply the relevant updates.
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 15 September 2022 11:47 am