Researchers have identified and patched a critical zero-day vulnerability in Windows that has been exploited in-the-wild, as a part of Microsoft’s latest Patch Tuesday update. The flaw, tracked as CVE-2021-43890, is described as a Windows AppX installer spoofing vulnerability, which if successfully exploited could allow an attacker to execute arbitrary malicious code. This flaw received a severity score of 7/10 due to the fact that although it is severe if successfully exploited, the attacker would still have to be savvy enough to gain access to the target system. The most common way that threat actors have been gaining their foothold within a vulnerable system is by hiding their malicious payload in a phishing email and tricking the victim into clicking on and executing that file. Multiple malware strains have been successfully delivered due to this vulnerability, and a Microsoft spokesperson stated, “Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/ Trickbot/ Bazaloader.”