Microsoft warns of Windows “PrintNightmare” vulnerability that’s being actively exploited

Microsoft is warning Windows customers about an unpatched essential flaw within the Windows Print Spooler service. The vulnerability, dubbed PrintNightmare, was uncovered earlier this week after safety researchers by chance revealed a proof-of-concept (PoC) exploit. While Microsoft hasn’t rated the vulnerability, it permits attackers to remotely execute code with system-level privileges, which is as essential and problematic as you will get in Windows.

Researchers at Sangfor published the PoC, in what seems to have been a mistake, or a miscommunication between the researchers and Microsoft. The check code was shortly deleted, however not earlier than it had already been forked on GitHub.

Sangfor researchers had been planning to detail a number of 0-day vulnerabilities within the Windows Print Spooler service on the annual Black Hat safety convention later this month. It seems the researchers thought Microsoft had patched this specific vulnerability, after the corporate revealed patches for a separate Windows Print Spooler flaw.

It has taken Microsoft a few days to lastly concern an alert concerning the 0-day, and Bleepingcomputer reports that the corporate is even warning prospects that it’s being actively exploited. The vulnerability permits attackers to make use of distant code execution, so dangerous actors may doubtlessly set up packages, modify information, and create new accounts with full admin rights.

Microsoft admits “the code that contains the vulnerability is in all versions of Windows,” but it surely’s not clear if it’s exploitable past server variations of Windows. The Print Spooler service runs by default on Windows, together with on consumer variations of the OS, Domain Controllers, and plenty of Windows Server cases, too.

Microsoft is engaged on a patch, however till it’s accessible the corporate recommends disabling the Windows Print Spooler service (if that’s an possibility for companies), or disabling inbound distant printing by means of Group Policy. The Cybersecurity and Infrastructure Security Agency (CISA) has recommended that admins “disable the Windows Print Spooler service in Domain Controllers and systems that do not print.”

Vulnerabilities within the Windows Print Spooler service have been a headache for system directors for years. The most notorious instance was the Stuxnet virus. Stuxnet used a number of 0-day exploits, together with a Windows Print Spooler flaw, to destroy a number of Iranian nuclear centrifuges greater than a decade in the past.