The 0patch vulnerability micropatching firm has released an unofficial security fix for a Windows zero-day flaw that has been active since the summer of 2021. The vulnerability, tracked as CVE-2021-34484, exists in the Windows User Profile Service, and if exploited, allows local attackers to escalate their privileges to SYSTEM under certain conditions. The vulnerability has been patched by Microsoft since last August, however security researchers eventually submitted a Proof-of-Concept (PoC) exploit that bypassed the fixes. In November when 0patch released the original unofficial patch to the exploitable “profext.dll” DLL file, it fixed the bug, however shortly thereafter when Microsoft officially patched the PoC bypass exploit (CVE-2022-21919), they replaced “profext.dll” which rendered the 0patch micropatch ineffective. 0patch has since ported their fix for “profext.dll” to work with the latest Microsoft update (March 2022), and due to the zero-day status of the vulnerability, the patch can be downloaded for free by creating a free account on 0patch central. The Ankura CTIX recommends all users and administrators running vulnerable instances of Windows 10 (v21H1, v20H2, v1909, and Windows Server 2019 64 bit) to download the micropatch immediately. Once 0patch is installed, the patch will be applied to the operating system automatically.