Patch Tuesday, May 2022
Microsoft's monthly security release, Tuesday, May 10, 2022. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
2 CVEs · 0 critical · 2 exploited · 1 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
2 CVEs · 0 critical · 2 exploited · 1 with public exploit code
- 8.8HighMay 10, 2022Microsoft Active Directory Crypto / certificateCVE-2022-26923An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM.Exploited84% likelyExploit codeMetasploit
- 8.1HighMay 10, 2022Microsoft Windows Auth bypass / access controlCVE-2022-26925Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.Exploited10% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.