## https://sploitus.com/exploit?id=AF392803-0CD4-5DE2-B9D2-5901D4891F33
# cve-2022-26809
https://www.pwndefend.com/2022/04/14/cve-2022-26809/
CVE-2022-26809
Vulnerability Information
Rating Critical
CVSS CVSS:3.1 9.8
Impact Remote Code Execution (RCE)
Exploit in the wild Currently not observed
Effort to Exploit (if PoC available) Low
Network Position TCP/IP Routable or Network Adjacent
Authentication Required to Exploit No
Affected Windows Client/Server OS
Typical Service Ports TCP 135,139,445
Vendor Patch Available Yes
Vendor Information
🔃 Security Update Guide - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26809
Guidance
• Ideally patch affected Windows Servers and Clients
Mitigation
• Ensure RPC is not exposed to the internet
• Restrict ingress network services that allow RPC (this could cause loss of availability)
• Restrict service based on role
• Restrict ingress services to specific segments/scopes e.g., use Windows Firewall to allow PAWS to connect via RPC for remote admin activities. Clearly consideration should be made for roles such as:
o Domain Controllers
o File & Print Servers
o Other services relying on RPC to operate
• Consider preparing a break glass GPO with restrictive host-based firewall rules allowing PAWS access)
Unknowns
• Does this affect RPC over HTTP?