Microsoft: Windows zero-day vulnerability under active exploitation

SecurityWeek reports that Microsoft has issued a warning about the active exploitation of a critical zero-day vulnerability stemming from the Windows Common Log File System. Threat actors have been abusing the flaw, tracked as CVE-2022-37969, to obtain SYSTEM privileges on Windows machines with updated patches, according to Microsoft. "An attacker must already have access and the ability to run code on the target system. This technique does not allow for remote code execution in cases where the attacker does not already have that ability on the target system," said Microsoft in its bulletin, which noted that the flaw has already been patched as part of this month's Patch Tuesday. Over 60 other security flaws have also been addressed by Microsoft for Patch Tuesday, with Trend Micro's Zero Day Initiative unit noting that security teams should prioritize fixes for the Windows TCP/IP remote code execution flaw, tracked as CVE-2022-34718; the Windows DNS Server denial-of-service bug, tracked as CVE-2022-34724; and the Chromium vulnerability, tracked as CVE-2022-3075.