A critical security vulnerability in Windows Server 2012 and Server 2012 R2 has been uncovered, allowing attackers to bypass essential security checks enforced by the Mark of the Web (MotW) feature.
This zero-day flaw, which has remained undetected for over two years, poses a significant threat to organizations still relying on these server versions, even those with fully updated systems and Extended Security Updates.
The newly discovered vulnerability affects certain types of files, potentially exposing servers to malicious attacks. While specific details are being withheld to prevent exploitation, the flaw’s longevity and its presence in fully patched systems underscore the critical nature of this security issue.
0patch security researchers identified the vulnerability and promptly reported it to Microsoft. In the interim, they have developed micropatches to address the issue, which will remain free until Microsoft releases an official fix.
Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar
This proactive approach aims to protect affected systems while awaiting a permanent solution from the software giant.
The vulnerability impacts:
To mitigate the risk, free micropatches have been made available for affected systems. These patches have been distributed to online computers with the 0patch Agent installed on PRO or Enterprise accounts, providing immediate protection against potential exploits.
This discovery highlights the ongoing security challenges faced by organizations using older Windows Server versions. It serves as a stark reminder of the importance of regular security audits and the need for robust patch management strategies.
Security experts recommend that organizations still relying on Windows Server 2012 and 2012 R2:
The emergence of this zero-day vulnerability underscores the constant evolution of cyber threats. It demonstrates that even systems believed to be fully updated can have critical security flaws.
As the cybersecurity community awaits Microsoft’s official fix, this vulnerability highlights the crucial role of independent security researchers and third-party patch providers in maintaining the integrity of widely used software systems.
Analyse Advanced Phishing Analysis With ANY.RUN Black Friday Deals : Get up to 3 Free Licenses.
Google has released an important Chrome 153 security update that fixes 42 vulnerabilities across the…
The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology…
CISA and five international cybersecurity agencies have released detailed guidance describing 17 common techniques hackers…
Apple has released one of its largest coordinated security rollouts, addressing 273 distinct critical vulnerabilities…
You can’t detect today's attacks with yesterday’s threat intelligence; that’s how you could briefly formulate…
Microsoft has published a draft Humanist AI Code of Conduct that would prohibit its in-house…