Hackers Exploiting Recently Reported Windows Print Spooler Vulnerability in the Wild

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting flaw (CWE-79) that allows remote attackers to inject arbitrary web script or HTML through the ZCS web interface. An attacker who successfully injects script can execute it in the browser context of a logged-in Zimbra user, enabling actions such as stealing session cookies or credentials, defacing webmail content, or chaining into further compromise; the specific injection vector is not detailed in the available data. Any organization running Zimbra Collaboration Suite, particularly deployments exposing the ZCS webmail interface to the internet, is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-19 with known ransomware use, and EPSS estimates a 25.3% probability of exploitation within 30 days (98th percentile), although no public proof-of-concept is known.

Do: Apply the latest Zimbra Collaboration Suite patches per Synacor's vendor instructions, as required by CISA's KEV listing, prioritizing internet-facing webmail servers given confirmed in-the-wild exploitation and known ransomware use. Because the affected version range is not specified in this data, check your current ZCS release against Synacor's advisory and upgrade to any patched release it designates. In the interim, restrict exposure of the ZCS web interface and monitor for unexpected injected script or HTML in webmail content.

A buffer overflow (CWE-122) in the VoIP telephony stack of WhatsApp allowed a remote attacker to achieve remote code execution on a target device by sending a specially crafted series of RTCP packets to the victim's phone number. Because the flaw resided in the call-handling stack of the core app, an attacker who could reach the target's phone number over the network could gain arbitrary code execution on the device. All WhatsApp users at the time of disclosure were potentially exposed, since the vulnerable component shipped in the mainstream Meta Platforms (then Facebook) product rather than an optional add-on. The vulnerability was added to CISA's Known Exploited Vulnerability catalog on 2022-04-19, indicating confirmed real-world exploitation, and its EPSS score of 39.2% (99th percentile) signals a high likelihood of continued exploitation; no public proof-of-concept is known. It was remediated in vendor updates issued in 2019 and is widely associated with targeted espionage use (notably Pegasus spyware deployments).

Do: Update WhatsApp on all mobile devices to the latest vendor release, per the CISA KEV required action; inventory your mobile fleet for outdated 2019-era builds and verify current app versions. Prioritize high-value targets (executives, journalists, government personnel) given the vulnerability's confirmed in-the-wild exploitation in espionage campaigns. No public PoC is known, but the flaw is remotely exploitable via network packets to a phone number, so treat patching as urgent.

CVE-2022-22718 is an elevation of privilege vulnerability in the Microsoft Windows Print Spooler service, the component that manages printing and print queues on Windows systems. A local attacker who can already execute low-privileged code on a vulnerable machine can exploit the flaw with no user interaction required. Successful exploitation grants elevated (SYSTEM-level) privileges, giving the attacker full control of the compromised host. The affected range spans essentially the entire supported Windows installed base at the time of disclosure, including Windows 7 through Windows 11 21H2 and Windows Server 2008. The flaw is known to be exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-19 and carries an 18.5% EPSS probability of exploitation within 30 days (97th percentile), though no public proof-of-concept is catalogued and ransomware use is listed as unknown.

Do: Apply Microsoft's security updates (released with the February 2022 Patch Tuesday and later cumulative updates) to every affected Windows system, per CISA's required action to update per vendor instructions; Windows 7 and 8.1 may require extended-security-update coverage. Prioritize multi-user and high-value hosts such as domain controllers, Remote Desktop Session Hosts, and print servers, where a local privilege escalation to SYSTEM is most impactful. As an interim mitigation where patching is delayed, consider disabling the Print Spooler service on systems that do not need printing.