Patch Tuesday, November 2022
Microsoft's monthly security release, Tuesday, November 8, 2022. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
6 CVEs · 0 critical · 6 exploited · 1 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
6 CVEs · 0 critical · 6 exploited · 1 with public exploit code
- 8.8HighNov 9, 2022Microsoft Exchange Server Privilege escalationCVE-2022-41080Microsoft Exchange Server is affected. An attacker gains elevated privileges and can execute arbitrary code. Patch Microsoft Exchange Server to the latest version and apply recommended security updates.Exploited77% likelyExploit code
- 8.8HighNov 9, 2022Microsoft Windows Memory corruptionCVE-2022-41128Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution.Exploited25% likely
- 7.8HighNov 9, 2022Microsoft Windows Memory corruptionCVE-2022-41073Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.Exploited2.4% likely
- 7.8HighNov 9, 2022Microsoft Windows Memory corruptionCVE-2022-41125Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.Exploited3% likely
- 5.4MediumNov 9, 2022Microsoft Windows Privilege escalationCVE-2022-41049Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.Exploited2.6% likely
- 5.4MediumNov 9, 2022Microsoft Windows Auth bypass / access controlCVE-2022-41091Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.Exploited1.9% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.