New 0Day Hack Attack Alert Issued For All Windows Users

Cybersecurity New 0Day Hack Attack Alert Issued For All Windows Users Davey Winder Senior Contributor Opinions expressed by Forbes Contributors are their own. Co-founder, Straight Talking Cyber New! Follow this author to improve your content experience. Got it! Jul 13, 2022, 04:48am EDT | Share to Facebook Share to Twitter Share to Linkedin Microsoft has confirmed newly discovered Windows security exploit is already under attack SOPA Images/LightRocket via Getty Images With 84 security issues requiring fixing, Microsoft’s monthly Patch Tuesday patch rollout is upon us.

While only four of these security vulnerabilities are classified by Microsoft as critical in nature, one does stand out for requiring your most urgent attention. What is the CVE-2022-22047 Windows 0Day? CVE-2022-22047 is, Microsoft confirms, already being exploited by attackers. Microsoft describes this 0Day security threat as a Windows client-server runtime subsystem (CSRSS) elevation of privilege vulnerability.

Almost every version of Windows is vulnerable to this threat, including Windows 7, 8. 1, 10, 11, and Windows Server 2008, 2012, 2016, 2019, and 2022. Perhaps surprisingly, CVE-2022-22047 isn’t given a critical rating by Microsoft but an important one instead.

MORE FROM FORBES Ransomware Surge As Dangerous New Gangs Take Over, Leaks Reveal By Davey Winder Is this a critical Windows vulnerability or not? Not everyone agrees with this classification. “Windows CSRSS Elevation of Privilege, tracked as CVE-2022-22047, is critical because it is actively exploited in the wild,” says Mike Walters, co-founder of Action1, a cloud-based monitoring specialist. “It has a 7.

8 CVSS score because it can only be executed locally,” Walters continues, adding that “use of this vulnerability gives an attacker SYSTEM privileges. ” Although the technical details are understandably sparse at this point in time, Walters warns that when paired with other attacks, it could give complete control of a Windows endpoint. MORE FROM FORBES VETTED 21 Amazon Prime Day Robot Vacuum Deals That Are Already Live By Sholeen Damarwala Forbes Staff 36 Prime Day Competitor Sales With Way Better Deals Than Amazon By Ciannah Gin Forbes Staff MORE FROM FORBES Microsoft Downplays ‘High-Risk’ Edge Security Warning For 150 Million Users By Davey Winder According to a Zero Day Initiative analysis of this latest Patch Tuesday security update, CVE-2022-22047 is precisely the type of vulnerability that is “typically paired with a code execution bug, usually a specially crafted Office or Adobe document, to take over a system.

” CISA orders federal agencies to patch Another indicator of how serious this 0Day exploit should be taken comes from the Cybersecurity & Infrastructure Security Agency (CISA). It has just added CVE-2022-22047 to its Known Exploited Vulnerabilities Catalog . This requires that federal agencies in the U.

S. now have until 2 August to patch their systems. This doesn’t mean you are off the hook if not a federal agency yourself.

CISA adds that it “strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. ” MORE FROM FORBES Google Warns Of Serious New Chrome Hack Attack Targeting Windows & Android By Davey Winder Follow me on Twitter or LinkedIn . Check out my website or some of my other work here .

Davey Winder Editorial Standards Print Reprints & Permissions.