As part of their Patch Tuesday security updates, Microsoft has patched a critical vulnerability affecting Windows hosts running the Remote Procedure Call (RPC) runtime, commonly utilized with the Windows Server Message Block (SMB) protocol. SMB is a Windows communication standard which allows the sharing of access to files, printers, as well as inter-process communication (IPC) across the nodes of remote severs in a network. The vulnerability, tracked as CVE-2022-26809, is a zero-click flaw, meaning that it gives attackers the ability to execute malicious code without interaction from a user. If exploited, this vulnerability allows unauthenticated attackers to leverage maliciously crafted TCP/IP packets in order to perform remote code execution (RCE) and spread laterally across the target network. Censys, a leading Attack Surface Management company, released a blog post that gives perspective to the scale of this vulnerability by detailing that, as of April 2022, 1,304,288 hosts are running the SMB protocol, and 63% of them are running a Windows-based operating system, the majority of them based in the United States. Given how little effort this vulnerability takes to exploit, the Ankura CTIX team expects to see a proof-of-concept (PoC) exploit, and an observable uptick in ransomware attacks in the near future. The CTIX team urges all Windows remote server administrators to ensure they have installed the latest Windows update on their infrastructure. If networks cannot be patched at this time due to scheduling and business processes, it is still very simple to mitigate RPC attacks in-general by simply instating firewall rules that block external connections.