December 2022 Patch Tuesday: Get Latest Security Updates from Microsoft and More

PowerShell Remote Code Execution Vulnerability

CVE-2022-41091 is a security feature bypass (CWE-863, incorrect authorization) in Microsoft Windows' Mark of the Web (MOTW) mechanism, which tags files downloaded from the internet so Windows can apply protective warnings such as SmartScreen prompts before the content runs. An attacker delivers a crafted file — typically a script or JavaScript payload — that fails to receive or retain the MOTW designation, so Windows treats it as locally created and the usual user warnings are skipped; exploitation requires user interaction (opening or running the file), per the CVSS vector. The bypass lets malware execute with fewer prompts, and Google's Threat Analysis Group reported that the Magniber ransomware gang used this flaw as a zero-day to launch JavaScript-delivered ransomware without MOTW-based warnings. Anyone running the affected Windows 10 builds (1507 through 22H2), Windows 11 (21H2 and 22H2), or Windows Server 2016/2019/2022 is affected. The flaw was actively exploited and added to CISA's Known Exploited Vulnerabilities catalog on 2022-11-08 with known ransomware use; Microsoft patched it in the November 2022 Patch Tuesday release (68 vulnerabilities, six zero-days), and no public PoC is known.

Do: Apply the November 2022 Windows security updates (released 2022-11-08) to all affected Windows 10, Windows 11, and Windows Server systems; this flaw is in CISA KEV with known ransomware use, so treat patching as urgent. Because Magniber exploited the bypass via JavaScript-delivered payloads that lacked the MOTW flag, review endpoints for JavaScript droppers or ransomware indicators and scrutinize downloaded script files. Until patched, treat internet-downloaded files and scripts with extra suspicion since they may run without the usual warnings.

Windows Print Spooler Elevation of Privilege Vulnerability

CVE-2022-44698 is a security feature bypass in Microsoft Defender SmartScreen in which specially crafted files do not properly trigger the SmartScreen Mark-of-the-Web warning prompt. The flaw is triggered over the network but requires user interaction: an attacker typically delivers a crafted file via a malicious link or phishing email, and when the user clicks or opens it, SmartScreen fails to show its usual warning. An attacker gains the ability to run malicious content on a user's machine without the standard SmartScreen prompt, making the flaw an effective delivery and initial-access aid — it has documented use in ransomware campaigns. Anyone running the affected Windows releases is exposed: Windows 10 versions 1607 through 22H2, Windows 11 21H2, and Windows Server 2016, 2019, and 2022. The vulnerability was exploited as a zero-day before patching, was added to CISA's Known Exploited Vulnerabilities catalog on 2022-12-13 with known ransomware use, and Google reported a ransomware gang abusing it in the wild.

Do: Apply Microsoft's December 2022 security updates (or any later cumulative updates) for Windows 10, Windows 11, and Windows Server, prioritizing user workstations and systems exposed to phishing or web downloads, per the CISA KEV required action. Until patched, reinforce user awareness that downloaded files may not trigger the usual SmartScreen warning, and consider restricting download or execution of risky file types. Confirm remediation against CISA KEV guidance and treat this as high-priority given known ransomware exploitation.

Microsoft Windows System Monitor (Sysmon) Elevation of Privilege Vulnerability

DirectX Graphics Kernel Elevation of Privilege Vulnerability