Microsoft patches a new zero-day affecting all versions of Windows

All supported versions of Windows that have been exploited in real-world attacks have been patched.

There is a zero-day bug in the Windows Common Log File System Driver. An attacker can get the highest level of access, known as system privileges, if they are able to exploit the bug.

Users who use Windows 11 and earlier are affected. Despite falling out of support in 2020, Windows 7 will get patches.

The flaw requires an attacker to have access to a compromised device or the ability to run code on the target system.

The Zero Day Initiative's head of threat intelligence said that bugs of this nature are often wrapped into some form of social engineering attack. Additional code takes over a system once they do.

CrowdStrike, Mandiant, and Zscaler were credited with reporting the flaw by Microsoft.

According to the senior principal vulnerability engineer at Mandiant, the bug was found during a proactive offensive task force exploit hunting mission.

Microsoft didn't respond to our request for comment about the attacks that exploited this vulnerability.

The fixes arrived as part of Microsoft's regularly scheduled monthly release of security fixes, called Patch Tuesday, which includes a total of 63 vulnerabilities in various Microsoft products.

There are two zero-day flaws that Microsoft has released patches for, one of which affects Windows 11 for ARM-based systems. The vulnerability can allow attackers to steal data from memory.

A zero-day under active attack was patched earlier this week.

Apple releases iOS and macOS fixes to patch a new zero-day under attack