Security News > 2022 > May > Microsoft closes Windows LSA hole under active attack

Microsoft patched 74 security flaws in its May Patch Tuesday batch of updates.

At least one of the vulnerabilities disclosed is under active attack with public exploit code, according to Redmond, while two others are listed as having public exploit code.

The bug that's being exploited in the wild is a Windows LSA spoofing vulnerability tracked as CVE-2022-26925.

While the software giant classified the attack complexity as "High," it also noted that the vuln is under active attack.

The second publicly disclosed bug, CVE-2022-22713, is a denial-of-service vulnerability in Windows Hyper-V. Microsoft says exploitation of this one is less likely and requires an attacker to win a race condition.

"The only thing that prevents this vulnerability from being tagged with a higher CVSS is the fact that an attacker must entice a victim to log on to the administration UI using a browser and that the attack is highly complex," the researchers wrote.

News URL

https://go.theregister.com/feed/www.theregister.com/2022/05/11/microsoft_patch_tuesday/