Microsoft’s September 2022 Patch Tuesday is here, and with it comes fixes for an actively exploited Windows vulnerability and  63 other flaws.

Five of the 63 vulnerabilities fixed in today’s update are classified as ‘Critical’ as they allow remote code execution, one of the most severe types of vulnerabilities.

The number of bugs in each vulnerability category is listed below:

• 1 Security Feature Bypass Vulnerabilities
• 7 Denial of Service Vulnerabilities
• 7 Information Disclosure Vulnerabilities
• 16 Edge – Chromium Vulnerabilities
• 18 Elevation of Privilege Vulnerabilities
• 30 Remote Code Execution Vulnerabilities

The above inventory does not include sixteen Microsoft Edge vulnerabilities fixed before this Patch Tuesday.

 

Multiple zero-days fixed, one actively exploited

September’s Patch Tuesday fixes two publicly disclosed zero-day vulnerabilities, with one actively exploited in attacks.

 

The actively exploited zero-day vulnerability fixed today is tracked as ‘CVE-2022-37969 – Windows Common Log File System Driver Elevation of Privilege Vulnerability.’

“An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” reads Microsoft’s advisory.

The exploited vulnerability was initially discovered by  CrowdStrike, DBAPPSecurity, Zscaler, and Mandiant.

It has been reported that Mandiant discovered the zero-day during a proactive Offensive Task Force exploit hunting mission.

Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.

The other disclosed vulnerability is known as ‘CVE-2022-23960 – Arm: CVE-2022-23960 Cache Speculation Restriction Vulnerability.’

 

The September 2022 Patch Tuesday Security Updates

The list below is of the resolved vulnerabilities and released advisories in the September 2022 Patch Tuesday updates.