Microsoft March 2022 Patch Tuesday: 71 vulnerabilities fixed

Microsoft has released 71 security fixes for software, including 41 patches for Microsoft Windows vulnerabilities, five vulnerabilities in Microsoft Office and two in Microsoft Exchange. 

Three of the vulnerabilities are rated critical — CVE-2022-22006, CVE-2022-24501 and CVE-2022-23277 — while the rest are rated important.

In the Redmond giant’s latest round of patches, usually released on the second Tuesday of each month in what is known as Patch Tuesday, Microsoft has fixed problems including remote code execution (RCE) vulnerabilities, denial of service bugs, privilege escalation bugs, spoofing issues, information leaks, and policy bypass exploits. 

None of the vulnerabilities are being actively exploited, but Sophos noted that a public proof-of-concept has been released for CVE-2022-21990.

March’s security update impacted products include Exchange, Visual Studio, the Xbox app for Windows, Intune, Microsoft Defender, Express Logic, Azure Site Recovery, and the Chromium-based Microsoft Edge browser, which had 21 vulnerabilities. 

They released updates for the following products:

o Microsoft Windows: 41 vulnerabilities
o Microsoft Office: 5 vulnerabilities
o Microsoft Exchange: 2 vulnerabilities 3/11 pic.twitter.com/kBSg5r08FC

— SophosLabs (@SophosLabs) March 8, 2022

Some of the other vulnerabilities of interest in this update are: 

• CVE-2022-24502: Internet Explorer Security Feature Bypass Vulnerability
• CVE-2022-24508: SMB Server Remote Code Execution Vulnerability
• CVE-2022-24512: .NET and Visual Studio Remote Code Execution Vulnerability
• CVE-2022-21990: Remote Desktop Client Remote Code Execution Vulnerability
• CVE-2022-23277: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2022-24459: Windows Fax and Scan Service Elevation of Privilege Vulnerability

Microsoft also announced a slate of updates to Windows 11 on Tuesday. 

Also: Microsoft is working on these new Windows 11 features hidden in test builds

In February, the tech giant released 48 security fixes for software, including a patch for a zero-day bug but no critical-severity flaws.

Cisco and Google also published security updates on Tuesday.