Microsoft re-marks SPNEGO NEGOEX vulnerability as "critical" after discovering that arbitrary code can be executed remotely

CTOnews.com, December 15, Microsoft disclosed and fixed the SPNEGO NEGOEX (CVE-2022-37958) vulnerability in its security update released in September this year. Microsoft marked the vulnerability as "critical" today after security experts discovered that it could also be used for remote code execution (RCE).

CTOnews.com learned that hackers could use the Server Message Block (SMB) or Remote Desktop Protocol (RDP) protocols to access the NEGOEX protocol on any authenticated Windows application protocol, thereby remotely executing arbitrary code. SPNEGO is also used for simple message transfer Protocol (SMTP) and Hypertext transfer Protocol (HTTP) when SPNEGO authentication is enabled.

Although Microsoft has now raised this vulnerability to "critical", it has a score of 8.1 (High) in CVSS 3.1because it is complex and requires many attempts to exploit it. Fortunately, a patch for this vulnerability was released in September this year.