Patch Tuesday, February 2022

Microsoft's monthly security release, Tuesday, February 8, 2022. Includes CVEs published within two days either side; Adobe and SAP ride the same day.

3 CVEs · 0 critical · 3 exploited · 3 with public exploit code

Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.

← January 2022 March 2022 →Open in the dashboard

Microsoft

3 CVEs · 0 critical · 3 exploited · 3 with public exploit code

7.8HighFeb 9, 2022Microsoft Windows Code / command injectionCVE-2022-21971Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution.Exploited54% likelyExploit code
7.8HighFeb 9, 2022Microsoft Windows Privilege escalationCVE-2022-21999Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation.Exploited41% likelyExploit codeMetasploit
7.8HighFeb 9, 2022Microsoft Windows Privilege escalationCVE-2022-22718Microsoft Windows Print Spooler contains an unspecified vulnerability which allow for privilege escalation.Exploited18% likelyExploit code

Adobe

No tracked Adobe CVEs in this window.

SAP

1 CVE · 1 critical · 1 exploited · 1 with public exploit code

9.8CriticalFeb 9, 2022SAP Multiple ProductsCVE-2022-22536SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.Exploited98% likelyExploit codeExploit-DB · NucleiDetection

The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.