Microsoft Patch Tuesday Fixes New Windows Zero

Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, because Azure Stack Edge allows customers to deploy Kubernetes workloads on their devices via Azure Arc, Azure Stack Edge devices are also vulnerable to this vulnerability.

Active Directory Certificate Services Elevation of Privilege Vulnerability

Windows Workstation Service Elevation of Privilege Vulnerability

CVE-2022-38028 is an elevation-of-privilege vulnerability (CVSS 3.1: 7.8) in the Microsoft Windows Print Spooler, the service that manages print jobs on Windows machines. An attacker who can already run low-privileged code on a vulnerable system can exploit the flaw locally, with no user interaction required, to escalate to SYSTEM privileges and take full control of the host (high confidentiality, integrity, and availability impact). It affects a broad set of Windows releases — Windows 10 builds 1507 through 21H2, Windows 11 22H2, Windows 8.1 and Windows RT 8.1, and Windows Server 2012, 2016, and 2019 — so most unpatched Windows estates are in scope. Exploitation is confirmed in the wild: CISA added the bug to the KEV catalog on 2024-04-23 (ransomware use unknown), and public reporting attributes active use to the Russia-linked APT28 group, whose custom 'GooseEgg' tool leverages this NSA-reported flaw to run payloads with elevated privileges; Microsoft shipped the fix in its April 2024 Patch Tuesday. EPSS is 14.9% (96th percentile), indicating elevated near-term exploitation risk on top of the already-observed APT28 activity.

Do: Apply Microsoft's security updates for the affected Windows releases (fixed in the April 2024 Patch Tuesday); as a KEV entry, CISA requires applying vendor mitigations or discontinuing use of unpatched versions. On servers where printing is not required, disabling the Print Spooler service removes the local attack path. Given confirmed APT28 use of the 'GooseEgg' exploit, hunt for related activity on unpatched hosts and prioritize patching endpoints belonging to organizations and users targeted by APT28.

CVE-2022-41033 is an elevation-of-privilege flaw in the Microsoft Windows COM+ Event System Service, classified under CWE-843 (access of a resource using an incompatible type). It is triggered locally: an attacker who can already execute code on a machine with limited (low-privilege) rights can exploit the vulnerable service with no user interaction, per the CVSS vector (AV:L/AC:L/PR:L/UI:N). Successful exploitation elevates the attacker to the highest local privilege level, with high impact on the confidentiality, integrity, and availability of the system — a typical post-compromise privilege-escalation step for an attacker who already has a foothold. The flaw affects the Windows releases in the CISA CPE data — Windows 7, 8.1, RT 8.1, Windows 10 (1507, 1607, 1809, 20H2, 21H1, 21H2), Windows 11 (21H2, 22H2), and Windows Server 2008 — meaning effectively the broad Windows installed base. Microsoft patched it in the October 2022 Patch Tuesday release and it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-10-11 as exploited in the wild; no public PoC is known, ransomware use is unknown, and EPSS currently estimates a 1.7% probability of exploitation in the next 30 days (75th percentile).

Do: Apply the October 2022 Windows security updates (or any later cumulative update) on all affected Windows clients and servers, prioritizing hosts where low-privileged users can run code, such as workstations, terminal/RDS servers, and VDI images — this also satisfies the CISA KEV required action. Until patched, treat any unprivileged compromise of a Windows host as potentially escalated to full local privilege, and restrict untrusted local code execution where possible. Verify remediation by confirming the October 2022 (or newer) cumulative update level on each host rather than relying on OS version alone.

Microsoft Office Information Disclosure Vulnerability