Microsoft has started rolling out an emergency Windows patch to address a critical flaw in the Windows Print Spooler service. The vulnerability, dubbed PrintNightmare, was revealed after security researchers accidentally published proof-of-concept (PoC) exploit code. Microsoft has issued OOB Update to address the flaw, and has rated it as critical as attackers can remotely execute code with system-level privileges on affected machines.
As the Print Spooler service runs by default on Windows, Microsoft has had to issue patches for Windows Server 2019, Windows Server 2012 R2, Windows Server 2008, Windows 8.1, Windows RT 8.1, and a variety of supported versions of Windows 10. Microsoft has even taken the unusual step of issuing patches for Windows 7, which was officially EOS last year.
Microsoft has not yet issued patches for Windows Server 2012, Windows Server 2016, and Windows 10 Version 1607, though. Microsoft says “security updates for these versions of Windows will be released soon.”
Microsoft took a couple of days to issue an alert about a 0-day affecting all supported versions of Windows.
“The security updates released on and after July 6, 2021 contain protections for CVE-2021-1675 and the additional remote code execution exploit in the Windows Print Spooler service known as ‘PrintNightmare’, documented in CVE-2021-34527.”