The November 2022 Microsoft “Patch Tuesday” update fixed sixty-eight (68) vulnerabilities, with eleven (11) of them being classified as critical. Of the eleven (11), two (2) are the zero-day attack-chain vulnerabilities known as “ProxyNotShell” which directly affect Exchange. Six (6) of the eleven (11) critical vulnerabilities have reportedly been exploited in-the-wild. Following the patch, the Cybersecurity and Infrastructure Security Agency (CISA) added four (4) zero-day flaws (not including ProxyNotShell) to its catalog of known exploited vulnerabilities (KEV), mandating that federal civilian executive branch (FCEB) agencies must patch all four (4) of the flaws before November 29, 2022. The first vulnerability added to the KEV, tracked as CVE-2022-41073, is an escalation of privileges flaw affecting the Windows Print Spooler service. If exploited, an attacker could elevate their privileges to SYSTEM, giving them full control of the target machine. This is a low complexity attack, similar to the devastating 2021 remote code execution (RCE) attacks facilitated by exploiting the notorious “PrintNighmare” bugs, which took almost four (4) months to successfully patch. The second flaw, tracked as CVE-2022-41125, is a Windows Cryptography API: Next Generation (CNG) key isolation service elevation of privilege vulnerability. CNG runs as the LocalSystem account, (a predefined local account used by the service control manager) sharing the executable “lsass[.]exe” with other services. The CNG service stores keys to authenticate users in the Winlogon service. If exploited, LSASS could be compromised to allow the threat actor to escalate their privileges and exfiltrate secret keys. The third vulnerability, tracked as CVE-2022-41091, is a Windows Mark of the Web (MotW) bypass vulnerability. MotW is a security feature that labels suspicious files and webpages. MotW labels tell the operating system, web browsers, and other applications that the file could be malicious, triggering a warning to the user informing them that opening the file or webpage could be dangerous. If exploited, this vulnerability could allow a threat actor to deliver maliciously crafted files within a ZIP archive that when extracted, would not have the embedded malicious macros marked by MotW flags, allowing for the successful download of malware on the vulnerable device. The final flaw added to the KEV, tracked as CVE-2022-41128, is a Windows scripting language vulnerability affecting the Jscript9 engine that leads to RCE. If exploited, an attacker could trick a user into visiting a maliciously crafted server or website, most likely via a phishing link or attachment, allowing the threat actor to execute arbitrary code from remote utilizing the user’s privileges. CTIX analysts urge all Microsoft customers to ensure that they are running the most up-to-date versions of their services.