Microsoft has patched a critical vulnerability in Windows as a part of January’s Patch Tuesday update. The flaw, tracked as CVE-2022-21907, is a remote code execution (RCE) vulnerability identified by Russian security researcher Mikhail Medvedev, and the flaw specifically affects the HTTP protocol stack, which processes HTTP requests via the Windows Internet Information Services (IIS) web server. If exploited, this vulnerability would give unauthenticated attackers the power to send maliciously crafted packets to a targeted server, and the fact that this exploit is “wormable,” means that it can self-propagate and spread without any user interaction. This flaw affects the most recent Windows desktop and server versions, including Windows 11 and Windows Server 2022, and the Ankura CTIX recommends that all Windows users ensure they are running the most recent Windows update to prevent any exploitation of this flaw.