IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Microsoft patches two zero-day vulnerabilities in last Patch Tuesday of 2022

Zero-days affecting Windows SmartScreen and DirectX were identified in the latest security update

Microsoft has issued fixes for two zero-day vulnerabilities in its final Patch Tuesday of the year.

In its latest bulletin, Microsoft said it will roll out security updates for a number of operating system components and software products, including Azure, Microsoft Dynamics, Windows Kernel, and SmartScreen.

The update batch includes 49 patched vulnerabilities, six of which are rated critical, and one that researchers identified as having been actively exploited.

This potentially exploited bug, tracked as CVE-2022-44698, affects Windows SmartScreen and would enable threat actors to bypass Mark of the Web (MOTW) protocols.

“An attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging,” Microsoft revealed in its security update.

Microsoft clarified that this particular flaw could be exploited in web-based attack scenarios whereby an attacker hosts a malicious website designed specifically to evade security protocols.

Similarly, attackers could leverage email or instant messaging to compromise users by sending a specially crafted .url file.

Microsoft also disclosed a second critical vulnerability, CVE-2022-44710, affecting the DirectX graphics kernel on Windows 11 22H2 systems. This was identified as an elevation of privilege vulnerability that, if successfully exploited, could enable an attacker to gain system privileges.

While recent observation reveals this has not been actively exploited, Microsoft gave the flaw a CVSS rating of 7.8, meaning it is high on the severity scale.

Critical Vulnerabilities

Microsoft has issued patches for all six critical flaws identified in its latest bulletin, which include:

CVE-2022-41127 (Microsoft Dynamics)
CVE-2022-44670 (Windows Secure Socket Tunneling Protocol)
CVE-2022-44676 (Windows Secure Socket Tunneling Protocol)
CVE-2022-41076 (PowerShell)
CVE-2022-44690 (SharePoint)
CVE-2022-44693 (SharePoint)

Greg Wiseman, lead product manager at Rapid7, told IT Pro that administrators for SharePoint and Microsoft Dynamics “should be aware of Critical Remote Code Execution (RCE) vulnerabilities” and implement patches immediately.

Patch Tuesday

Microsoft’s final Patch Tuesday of 2022 appears to have been a relatively light month in comparison to November.

Last month saw fixes for six exploited zero-day vulnerabilities and the disclosure of 68 flaws, 11 of which were classified as critical and allowed privilege elevation and remote code execution.

Related Resource

Technology Ecosystem benchmark report

The evolution of the IT industry

Whitepaper cover with dark background image of a pin in a map over EuropeFree Download

However, Mark Lamb, CEO of HighGround.io, warned that organisations should remain vigilant and prioritise patches to mitigate potential risks.

“It’s the last Patch Tuesday of 2022, and while not as major as last month’s update, we are still finishing the year off with a bang,” he said.

“Two zero-days and six critical flaws, which provide criminals with remote code execution, privileged access and denial of service, among other things. This means a major update and organisations must apply patches as soon as possible,” Lamb added.  

Featured Resources

2023 Strategic roadmap for data security platform convergence

Capitalise on your data and share it securely using consolidated platforms

Free Download

The 3D trends report

Presenting one of the most exciting frontiers in visual culture

Free Download

The Total Economic Impact™ of IBM Cloud Pak® for Watson AIOps with Instana

Cost savings and business benefits

Free Download

Leverage automated APM to accelerate CI/CD and boost application performance

Constant change to meet fast-evolving application functionality

Free Download

Recommended

Microsoft Azure spending notifications unavailable until March
Cloud

Microsoft Azure spending notifications unavailable until March

2 Feb 2023
Hackers target business cloud environments by abusing Microsoft’s ‘verified publisher’ status
Security

Hackers target business cloud environments by abusing Microsoft’s ‘verified publisher’ status

1 Feb 2023
Google to cut global workforce by 12,000 roles
Careers & training

Google to cut global workforce by 12,000 roles

20 Jan 2023
Windows 11 System Restore bug preventing users from accessing apps
Microsoft Windows

Windows 11 System Restore bug preventing users from accessing apps

19 Jan 2023

Most Popular

Yandex data breach reveals source code littered with racist language
data breaches

Yandex data breach reveals source code littered with racist language

30 Jan 2023
Dutch hacker steals data from virtually entire population of Austria
data breaches

Dutch hacker steals data from virtually entire population of Austria

26 Jan 2023
What's powering Britain’s fibre broadband boom?
Network & Internet

What's powering Britain’s fibre broadband boom?

3 Feb 2023