Virtual Event: Threat Detection and Incident Response Summit - Watch Sessions
Connect with us

Hi, what are you looking for?


Application Security

Patch Tuesday: Microsoft Fixes Multiple Code Execution Flaws

Microsoft’s Patch Tuesday bundle for this month is a big one: 74 documented vulnerabilities in multiple Windows products and components, some serious enough to lead to remote code execution attacks.

Microsoft’s Patch Tuesday bundle for this month is a big one: 74 documented vulnerabilities in multiple Windows products and components, some serious enough to lead to remote code execution attacks.

The Redmond, Wash.-based software giant cautioned that exploit code is publicly available for three of the patched vulnerabilities — remote code execution bugs in Remote Desktop Client and .NET and Visual Studio, and a privilege escalation flaw in the Windows Fax and Scan service.

“In the case of a Remote Desktop connection, an attacker with control of a Remote Desktop Server could trigger a remote code execution (RCE) on the RDP client machine when a victim connects to the attacking server with the vulnerable Remote Desktop Client,” Microsoft explained in an ‘important’ advisory.

The March patch batch contains fixes for three issues rated “critical,” Microsoft’s highest severity rating.  These include remote code execution vulnerabilities in Microsoft Exchange Server and the HEVC and VP0 video extensions.

Microsoft said it had no evidence that any of the vulnerabilities were exploited in the wild as zero-day.

[ PREVIOUSLY: Patch Tuesday: Windows Flaw Under Active Attack ]

Vulnerability trackers at the Zero Day Initiative are calling special attention to the Microsoft Exchange server flaw — CVE-2022-23277 — as one that needs to be tested and deployed with urgency.

Advertisement. Scroll to continue reading.

“The [Exchange Server] vulnerability would allow an authenticated attacker to execute their code with elevated privileges through a network call. This is also listed as low complexity with exploitation more likely, so it would not surprise me to see this bug exploited in the wild soon – despite the authentication requirement. Test and deploy this to your Exchange servers quickly,” ZDI urged in a blog post.

The Microsoft patches also cover numerous code execution, denial-of-service and elevation of privilege issues in Azure Site Recovery and additional bugs in Microsoft Defender, Microsoft Office, and Windows Event Tracing.

Microsoft’s patches were released hours after software maker Adobe rolled out urgent security updates to address code execution vulnerabilities in Illustrator and After Effects products.

The Adobe patches cover arbitrary code execution and memory leak vulnerabilities that could expose data to malicious hacker attacks.

[ READ: Microsoft Calls Attention to ‘Wormable’ Windows Security Flaw ]

The most serious of the vulnerabilities was addressed in Adobe Illustrator, the popular vector graphics design program available for both macOS and Windows systems.

In an advisory, Adobe rated the Illustrator flaw as “critical” with a CVSS base score of 7.8. The company described the CVE-2022-23187 bug as a buffer overflow affecting Illustrator 2022 version 26.0.3 (and earlier versions) on both WIndows and macOS machines.

Adobe is strongly urging users to upgrade to Illustrator 2022 version 26.1.0.

The San Jose, Calif.-based Adobe also issued a separate alert to warn of at least four critical flaws haunting users of After Effects, another popular software product used in motion graphics creative projects.

The quartet of bugs are all described as stack-based buffer overflows that could allow computer takeover attacks.

Related: Microsoft Patch Tuesday: Windows Flaw Under Active Attack

Related: Microsoft Office Zero-Day Hit in Targeted Attacks

Related: Adobe Joins Security Patch Tuesday Frenzy

Related: Adobe Warns of Critical Flaws in Magento, Connect

Related: Did Microsoft Botch the PrintNightmare Patch?

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...


WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Artificial Intelligence

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...