Microsoft has released security updates to address several vulnerabilities in the following products:

• Active Directory Domain Services
• Azure
• Azure Arc
• Client Server Run-time Subsystem (CSRSS)
• Microsoft Edge (Chromium-based)
• Microsoft Graphics Component
• Microsoft Office
• Microsoft Office SharePoint
• Microsoft Office Word
• Microsoft WDAC OLE DB provider for SQL
• NuGet Client
• Remote Access Service Point-to-Point Tunneling Protocol
• Role: Windows Hyper-V
• Service Fabric
• Visual Studio Code
• Windows Active Directory Certificate Services
• Windows ALPC
• Windows CD-ROM Driver
• Windows COM+ Event System Service
• Windows Connected User Experiences and Telemetry
• Windows CryptoAPI
• Windows Defender
• Windows DHCP Client
• Windows Distributed File System (DFS)
• Windows DWM Core Library
• Windows Event Logging Service
• Windows Group Policy
• Windows Group Policy Preference Client
• Windows Internet Key Exchange (IKE) Protocol
• Windows Kernel
• Windows Local Security Authority (LSA)
• Windows Local Security Authority Subsystem Service (LSASS)
• Windows Local Session Manager (LSM)
• Windows NTFS
• Windows NTLM
• Windows ODBC Driver
• Windows Perception Simulation Service
• Windows Point-to-Point Tunneling Protocol
• Windows Portable Device Enumerator Service
• Windows Print Spooler Components
• Windows Resilient File System (ReFS)
• Windows Secure Channel
• Windows Security Support Provider Interface
• Windows Server Remotely Accessible Registry Keys
• Windows Server Service
• Windows Storage
• Windows TCP/IP
• Windows USB Serial Driver
• Windows Web Account Manager
• Windows Win32K
• Windows WLAN Service
• Windows Workstation Service

Attacker could exploit these vulnerabilities by doing the following:

• Remote Code Execution
• Denial of Service (DoS)
• Unauthorized disclosure of information
• Escalation of privilege
• Bypass of a protection mechanism
• Spoofing

The CERT team encourages users to review Microsoft security advisory and apply the necessary updates:

• https://msrc.microsoft.com/update-guide/releaseNote/2022-Oct