Today’s VERT Alert addresses Microsoft’s February 2022 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-985 on Wednesday, February 9th.

In-The-Wild & Disclosed CVEs

CVE-2022-21989

This month, only a single vulnerability, CVE-2022-21989 has been publicly disclosed and Microsoft is not reporting any known public exploitation. Additionally, Microsoft has stated that the attack complexity of this vulnerability is high because an attacker must “prepare the target environment” for exploitation. Microsoft offers an isolated execution environment by means of AppContainer, which minimizes risk by limiting access to resources and other applications. In this case, however, Microsoft has noted that the attack can be performed from an AppContainer and allow the attacker to execute code that allows access to resources that they shouldn’t normally be able to access.

Microsoft has rated this as Exploitation More Likely on the latest software release on the Exploitability Index.

CVE Breakdown by Tag

While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per tag basis. Vulnerabilities are also colour coded to aid with identifying key issues.

• Traditional Software
• Mobile Software
• Cloud or Cloud Adjacent
• Vulnerabilities that are being exploited or that have been disclosed will be bold.