Microsoft released its monthly Patch Tuesday security update which disclosed sixty-four (64) vulnerabilities across the company’s hardware and software products. This includes five (5) critical remote code execution (RCE) flaws, and two (2) zero-day vulnerabilities, one which has been actively exploited in-the-wild. The most troubling vulnerability patched this month is an actively exploited Windows zero-day Common Log File System (CLFS) driver escalation of privilege (EOP) vulnerability. This flaw, tracked as CVE-2022-37969, was discovered by multiple research firms during a proactive Offensive Task Force exploit hunting mission, and if exploited could allow malicious attackers to escalate their local privileges to SYSTEM. Once SYSTEM privileges are successfully attained, threat actors could make unauthorized configuration changes, disable security applications, create new privileged users, steal sensitive data, and much more malicious cyber activity. On September 14, 2022, The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2022-37969 to its Known Exploited Vulnerabilities (KEV) catalog, requiring all federal civilian executive branch (FCEB) agencies to patch the flaw by no later than October 5, 2022. Although it’s considered to be the most severe due to its low-complexity and active exploitation, this vulnerability has been given a relatively low CVSS score of 7.8/10 due to the fact that an attacker would first need to gain access to the vulnerable host. EOP flaws are highly sought after by threat actors, often being one of the first actions taken after gaining initial access to a vulnerable system. There are working proof-of-concept (PoC) exploits for this vulnerability, meaning that less sophisticated attackers will be attempting to exploit it. It should be noted that compared to last month’s record number of 120 vulnerabilities, this patch represents a significant decline. For details about all of the patched vulnerabilities, please reference the Microsoft Security Update Guide linked below. To prevent exploitation of any of the reported vulnerabilities, CTIX analysts recommend Windows administrators ensure that all systems are running the September 2022 patch.