{"id":55552,"date":"2024-03-11T04:28:10","date_gmt":"2024-03-11T04:28:10","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\/"},"modified":"2024-03-11T04:28:10","modified_gmt":"2024-03-11T04:28:10","slug":"microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\/","title":{"rendered":"Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability"},"content":{"rendered":"<p><span class=\"label\">Infosec in brief<\/span> Cybersecurity researchers informed Microsoft that Notorious North Korean hackers Lazarus Group discovered the &#8220;holy grail&#8221; of rootkit vulnerabilities in Windows last year, but Redmond still took six months to patch the problem.<\/p>\n<p>Researchers at Avast <a href=\"https:\/\/decoded.avast.io\/janvojtesek\/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day\/\" rel=\"nofollow\">said<\/a> they informed Microsoft of a serious admin-to-kernel exploit in a driver associated with AppLocker, the app for whitelisting software built into Windows, in August of last year.<\/p>\n<p>The vulnerability, found in the input\/output control dispatcher of appid.sys, meant it was accessible from userspace while communicating with the Windows kernel.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"condor\" data-xsm=\",fluid,mpu,\" data-sm=\",fluid,mpu,\" data-md=\",fluid,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>&#8220;A user-space attacker could abuse it to essentially trick the kernel into calling an arbitrary pointer,&#8221; Avast said. &#8220;This presented an ideal exploitation scenario, allowing the attacker to call an arbitrary kernel function with a high degree of control over the first argument.&#8221;<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xmd=\",fluid,mpu,leaderboard,\" data-lg=\",fluid,mpu,leaderboard,\" data-xlg=\",fluid,billboard,superleaderboard,mpu,leaderboard,\" data-xxlg=\",fluid,billboard,superleaderboard,brandwidth,brandimpact,leaderboard,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<div class=\"adun_eagle_desktop_story_wrapper\">\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"mid\" data-raptor=\"eagle\" data-xxlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<\/p><\/div>\n<p>Avast claims Lazarus Group used the vulnerability to obtain read\/write primitive on the Windows kernel and install their FudModule rootkit, but Microsoft&#8217;s opinion on the severity of admin-to-kernel exploits meant it didn&#8217;t prioritize the matter, waiting until <a href=\"https:\/\/www.theregister.com\/2024\/02\/14\/patch_tuesday_feb_2024\/\">February&#8217;s patch Tuesday<\/a> to fix the issue, which it tagged as <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2024-21338\" rel=\"nofollow\">CVE-2024-21338<\/a>, with a CVSS score of 8\/10.<\/p>\n<p>&#8220;Some Windows components and configurations are explicitly not intended to provide a robust security boundary,&#8221; Microsoft states on its Security Servicing criteria <a href=\"https:\/\/www.microsoft.com\/en-us\/msrc\/windows-security-servicing-criteria\" rel=\"nofollow\">page<\/a>. What that means, Avast said, is that &#8220;Microsoft reserves the right to patch admin-to-kernel vulnerabilities at its own discretion.&#8221;<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xsm=\",fluid,mpu,\" data-sm=\",fluid,mpu,\" data-md=\",fluid,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>Of admin-to-kernel issues, Microsoft said administrative processes and users are part of Trusted Computing Base for Windows, and thus &#8220;not strong [sic] isolated from the kernel boundary.&#8221;<\/p>\n<p>Unfortunately in this case, that meant Lazarus Group was able to play in victims\u2019 kernels for months without Microsoft doing a thing.<\/p>\n<p>Even when it patched the vulnerability, Microsoft <a href=\"https:\/\/arstechnica.com\/security\/2024\/03\/hackers-exploited-windows-0-day-for-6-months-after-microsoft-knew-of-it\/\" rel=\"nofollow\">reportedly<\/a> didn&#8217;t disclose that the matter was under active exploitation when it issued a patch. That disclosure came when Avast published its report on the matter recently, which prompted Microsoft to update its patch bulletin.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" id=\"story_eagle_xsm_sm_md_xmd_lg_xlg\" data-pos=\"mid\" data-raptor=\"eagle\" data-xsm=\",mpu,dmpu,\" data-sm=\",mpu,dmpu,\" data-md=\",mpu,dmpu,\" data-xmd=\",mpu,dmpu,\" data-lg=\",mpu,dmpu,\" data-xlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>We&#8217;ve asked Microsoft for an explanation, and will let you know if we get one.<\/p>\n<div class=\"boxout\" readability=\"26.865325077399\">\n<h3 class=\"crosshead\">Critical vulnerabilities of the week: Better update iOS<\/h3>\n<p>The leading critical vulnerabilities this week can be found in a long list of Apple security updates released for iOS and iPadOS versions <a href=\"https:\/\/support.apple.com\/en-us\/HT214081\" rel=\"nofollow\">17.4<\/a> and <a href=\"https:\/\/support.apple.com\/en-us\/HT214082\" rel=\"nofollow\">16.7.6<\/a>, the former being the most recent version, and the latter being an older OS still used on some older devices.<\/p>\n<p>Not all of the vulnerabilities in the list are critical, but several are \u2013 such as <a href=\"https:\/\/www.tenable.com\/cve\/CVE-2024-23277\" rel=\"nofollow\">CVE-2024-23277<\/a>, which would allow an attacker to spoof a keyboard and inject keystrokes, <a href=\"https:\/\/www.tenable.com\/cve\/CVE-2024-23288\" rel=\"nofollow\">CVE-2024-23288<\/a>, a privilege escalation bug and CVE-2024-23243, which <a href=\"https:\/\/www.theregister.com\/2024\/03\/06\/ios_17_4_eu_compliance\/\">we covered previously<\/a>.<\/p>\n<p>Note that two of the issues Apple patched this week &#8211; <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-23225\" rel=\"nofollow\">CVE-2024-23225<\/a> and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-23296\" rel=\"nofollow\">CVE-2024-23296<\/a> &#8211; are under active exploitation, per CISA.<\/p>\n<p>Apple also <a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2024\/03\/08\/apple-released-security-updates-multiple-products\" rel=\"nofollow\">released<\/a> security updates for all its other various OSes, and Safari, today, so get patching.<\/p>\n<p>Elsewhere:<\/p>\n<ul>\n<li>CVSS 10.0 &#8211; <a href=\"https:\/\/www.cisa.gov\/news-events\/ics-advisories\/icsa-24-065-01\" rel=\"nofollow\">Multiple CVEs<\/a>: Linear eMerge E3 series access control devices contain a number of flaws that could see a remote attacker gain full system access.<\/li>\n<li>CVSS 9.1 &#8211; <a href=\"https:\/\/www.cisa.gov\/news-events\/ics-advisories\/icsa-24-067-01\" rel=\"nofollow\">CVE-2024-2197<\/a>: Chirp, also an access management product, is improperly storing credentials in its Chirp Access app.<\/li>\n<li>CVSS 8.2 &#8211; <a href=\"https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-secure-client-crlf-W43V4G7\" rel=\"nofollow\">CVE-2024-20337<\/a>: Cisco Secure Client is insufficiently validating user input during the SAML authentication process, allowing an attacker to execute arbitrary code.<\/li>\n<\/ul>\n<\/div>\n<h3 class=\"crosshead\">NSA shares its cloud security mitigation tips<\/h3>\n<p>Cloud computing can be great \u2026 or create serious security risks, which is why the US National Security Agency and the Cybersecurity and Infrastructure Security Agency have teamed to share ten tips on how to mitigate risks.<\/p>\n<p>Among the tips are some you&#8217;d expect, like following proper identity and access management practices, managing logs, properly managing access keys, and the like. Others are \u2026 well, still pretty obvious, but might need to be pointed out.<\/p>\n<p>Those include segmenting your networks and applying encryption in cloud environments, properly defending CI\/CD environments, and remembering to account for complexities introduced by hybrid and multi-cloud environments.<\/p>\n<p>&#8220;Using the cloud can make IT more efficient and more secure, but only if it is implemented right,&#8221; said NSA cybersecurity director Rob Joyce. &#8220;This series provides foundational advice every cloud customer should follow to ensure they don&#8217;t become a victim.&#8221;<\/p>\n<p>You can find the whole list of tips, each one pointing to a separate report and implementation tips, <a href=\"https:\/\/www.nsa.gov\/Press-Room\/Press-Releases-Statements\/Press-Release-View\/Article\/3699169\/nsa-releases-top-ten-cloud-security-mitigation-strategies\/\" rel=\"nofollow\">here<\/a>.<\/p>\n<h3 class=\"crosshead\">White House, OSS groups offer cybersecurity training to Jordanian women<\/h3>\n<p>In honor of Women&#8217;s History Month, the White House National Security Council, Linux Foundation Training and Certification, the Open Source Security Foundation (OpenSSF) and Cloud Native Computing Foundation (CNCF) have teamed up to help Jordanian women get trained up to join the cybersecurity workforce with a new pilot program.<\/p>\n<p>The initiative will provide 250 Jordanian women access to more than 100 free security courses and around 25 certifications, including ones related to Kubernetes and cloud native security, the Linux Foundation told <em>The Register<\/em>.<\/p>\n<p>&#8220;As cybersecurity continues to experience challenges in finding enough skilled workers, this program will help build capacity in the workforce,&#8221; OpenSSF <a href=\"https:\/\/openssf.org\/blog\/2024\/03\/04\/openssf-and-linux-foundation-training-certification-announce-scholarships-to-support-women-in-jordan-entering-the-cybersecurity-field-in-collaboration-with-us-white-house\/\" rel=\"nofollow\">said<\/a>.<\/p>\n<p>According to USAID, <a href=\"https:\/\/www.usaid.gov\/jordan\/women-youth\" rel=\"nofollow\">fewer<\/a> than one-fifth of Jordanian women are part of the workforce, and social norms in the country generally discourage women from working outside the home.<\/p>\n<p>&#8220;By providing complementary security certifications, we aim to break down barriers and create opportunities for women in Jordan, fostering a more inclusive and diverse workforce,&#8221; OpenSSF said.<\/p>\n<p>The announcement comes as the US and Jordan held their second digital dialogue <a href=\"https:\/\/www.state.gov\/joint-statement-on-the-second-u-s-jordan-cyber-and-digital-dialogue\/\" rel=\"nofollow\">conference<\/a>, which included discussion on upskilling Jordan&#8217;s workforce, specifically women, to pursue cybersecurity careers.<\/p>\n<p>Omkhar Arasaratnam, general manager at OpenSSF, told us that if the program is successful, similar initiatives may follow in other nations. \u00ae<\/p>\n<p> READ MORE <a href=\"https:\/\/go.theregister.com\/feed\/www.theregister.com\/2024\/03\/11\/infosec_news_in_brief\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>PLUS: NSA shares cloud security tips; Infosec training for Jordanian women; Critical vulnerabilities Infosec in brief\u00a0 Cybersecurity researchers informed Microsoft that Notorious North Korean hackers Lazarus Group discovered the &#8220;holy grail&#8221; of rootkit vulnerabilities in Windows last year, but Redmond still took six months to patch the problem.\u2026  READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[],"class_list":["post-55552","post","type-post","status-publish","format-standard","hentry","category-the-register"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2024-03-11T04:28:10+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability\",\"datePublished\":\"2024-03-11T04:28:10+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\\\/\"},\"wordCount\":945,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\\\/\",\"name\":\"Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"datePublished\":\"2024-03-11T04:28:10+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\\\/#primaryimage\",\"url\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"contentUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\/","og_locale":"en_US","og_type":"article","og_title":"Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2024-03-11T04:28:10+00:00","og_image":[{"url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability","datePublished":"2024-03-11T04:28:10+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\/"},"wordCount":945,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\/","url":"https:\/\/www.threatshub.org\/blog\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\/","name":"Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","datePublished":"2024-03-11T04:28:10+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\/#primaryimage","url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","contentUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Ze69DGPk1V-nKNu4hAnJLgAAABA&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/microsoft-waited-6-months-to-patch-actively-exploited-admin-to-kernel-vulnerability\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/55552","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=55552"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/55552\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=55552"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=55552"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=55552"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}