Patch Tuesday, December 2021
Microsoft's monthly security release, Tuesday, December 14, 2021. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
2 CVEs · 0 critical · 2 exploited · 1 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
2 CVEs · 0 critical · 2 exploited · 1 with public exploit code
- 7.8HighDec 15, 2021Microsoft Windows Privilege escalationCVE-2021-43226Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms.Exploited3.3% likelyExploit code
- 7.1HighDec 15, 2021Microsoft WindowsCVE-2021-43890Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.Exploited11% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.