{"id":29154,"date":"2023-01-11T01:09:35","date_gmt":"2023-01-11T01:09:35","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2023\/01\/11\/first-patch-tuesday-of-2023-includes-in-the-wild-exploit-the-register\/"},"modified":"2023-01-11T01:09:35","modified_gmt":"2023-01-11T01:09:35","slug":"first-patch-tuesday-of-2023-includes-in-the-wild-exploit-the-register","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2023\/01\/11\/first-patch-tuesday-of-2023-includes-in-the-wild-exploit-the-register\/","title":{"rendered":"First Patch Tuesday of 2023 includes in-the-wild exploit \u2022 The Register"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n

Patch Tuesday<\/span> Microsoft fixed 98 security flaws in its first Patch Tuesday of 2023 including one that’s already been exploited and another listed as publicly known. Of the new January vulnerabilities, 11 are rated critical because they lead to remote code execution.<\/p>\n

The bug that’s under exploit, tracked as CVE-2023-21674<\/a>, is an advanced local procedure call elevation of privilege vulnerability that received an 8.8 CVSS rating.<\/p>\n

Redmond, per usual, provides scant details about the security hole and zero details about how miscreants are abusing the vulnerability. It does note that it could allow a local attacker to escalate privileges all the way up to SYSTEM level.<\/p>\n

\n