Microsoft Patch Tuesday – April 2022

Patch Tuesday is once again upon us. The April 2022 edition of Patch Tuesday brings us 117 fixes, with 9 rated as critical. We’ve listed the most important changes below.

⚡ TL;DR | Go Straight to the April 2022 Patch Tuesday Audit Report

Windows Network File System RCE

One of the most critical vulnerabilities addressed in this month’s Patch Tuesday is a Windows Network File System Remote Code Execution vulnerability. Listed as CVE-2022-24491, this vulnerability has a CVSS base score of 9.8 in addition to Microsoft listing the exploitability as “Exploitation More Likely”. If exploited an attacker could send a specially crafted NFS protocol network message to a vulnerable Windows machine, which could enable remote code execution.

One important detail is that only servers with the Network File System (NFS) role installed are vulnerable, luckily, you can get a quick overview of all Windows Servers with the NFS role installed with the Lansweeper report.

Remote Procedure Call Runtime RCE

The second vulnerability with a CVSS base score of 9.8 is CVE-2022-26809. Similar to the NFS vulnerability, this one is also more than likely to be exploited according to Microsoft. To exploit this vulnerability, an attacker would need to send a specially crafted RPC call to an RPC host. This could result in remote code execution on the server-side with the same permissions as the RPC service.

Microsoft has listed some mitigation options, however, installing the update to fix the vulnerability is obviously the preferred solution. If you’re unable to perform this update quickly, you can already do the following

1. Block TCP port 445 at the enterprise perimeter firewall

TCP port 445 is used to initiate a connection with the affected component. This can help protect networks from attacks that originate outside the enterprise perimeter. However, systems could still be vulnerable to attacks from within their enterprise perimeter.

2. Follow Microsoft guidelines to secure SMB traffic

Remaining Critical Vulnerabilities

Aside from the two vulnerabilities above, the following critical vulnerabilities are also worth taking a look at if you’re running affecting components:

Run the Patch Tuesday April 2022 Audit Report

To help manage your update progress, we’ve created the Patch Tuesday Audit Report that checks if the assets in your network are on the latest patch updates. The report has been color-coded to see at a glance which machines are up-to-date and which ones still need to be updated. As always, system administrators are urged to update their environment as soon as possible to ensure all endpoints are secured

Patch Tuesday April 2022 CVE Codes & Titles

Receive the Latest Patch Tuesday Report for FREE Every Month

"*" indicates required fields

Email*

This field is hidden when viewing the form

EmailType

This field is hidden when viewing the form

IM – Conv Page – Processing

This field is hidden when viewing the form

IM – UTM_Campaign FC – Processing

This field is hidden when viewing the form

IM – UTM_Campaign LC – Processing

This field is hidden when viewing the form

IM – UTM_Content FC – Processing

This field is hidden when viewing the form

IM – UTM_Content LC – Processing

This field is hidden when viewing the form

IM – UTM_Medium FC – Processing

This field is hidden when viewing the form

IM – UTM_Medium LC – Processing

This field is hidden when viewing the form

IM – UTM_Source FC – Processing

This field is hidden when viewing the form

IM – UTM_Source LC – Processing

This field is hidden when viewing the form

IM – UTM_Term FC – Processing

This field is hidden when viewing the form

IM – UTM_Term LC – Processing

This field is hidden when viewing the form

gclid

This field is hidden when viewing the form

msclkid

Name

This field is for validation purposes and should be left unchanged.

Count Me In Submit