February 2022 Patch Tuesday is here and it’s all-around “light” – light in fixed CVE-numbered vulnerabilities (51), extremely light in critical fixes (50 are “important” and one is “moderate”), and light in exploited vulnerabilities (none of the vulnerabilities are listed as under active attack). Only one is listed as publicly known – CVE-2022-21989, a Windows Kernel EOP flaw – but while there’s apparently a PoC exploit out there (not necessarily public), “Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment.” Microsoft also noted that exploitation of the vulnerability could be performed from a low privilege AppContainer.

Read full article on Help Net Security