Visit us at GITEX 2023 to witness the power of Hive Pro TEM Platform: Schedule a Meeting

Three zero-days addressed in Microsoft’s May 2022 Patch Tuesday

Threat Advisories

Three zero-days addressed in Microsoft’s May 2022 Patch Tuesday


For a detailed advisory, download the pdf file here

Microsoft addressed 74 vulnerabilities in their May 2022 Patch Tuesday Security Update. Three of them are zero-days, and one is being exploited in the wild.

The LSA Spoofing vulnerability (CVE-2022-26925) is actively exploited in the wild and allows an unauthenticated attacker to call a method on the LSARPC interface and compel the domain controller to use NTLM to authenticate the attacker. Successful exploitation of the second zero-day vulnerability(CVE-2022-22713) requires an attacker to win a race condition. The third zero-day vulnerability affects the Microsoft Integration Runtime services in the Magnitude Simba Amazon Redshift ODBC Driver.

Organizations have advised the patch of all these vulnerabilities as soon as possible to avoid exploitation.

Potential MITRE ATT&CK TTPs are:

TA0042: Resource Development

T1588: Obtain Capabilities

T1588.006: Obtain Capabilities: Vulnerabilities

TA0001: Initial Access

T1190: Exploit Public-Facing Application

TA0006: Credential Access

T1557: Adversary-in-the-Middle

Vulnerability Details


Patch Links


Sign up to receive our Weekly Threat Digest