Skip to content
OpenAdvisories
High MSRC-CVE-2022-23278 1 CVE

Microsoft Defender for Endpoint Spoofing Vulnerability

Published Mar 8, 2022 · Updated Jul 8, 2025 · Revision 4

Vendor: Microsoft

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to gather information specific to the environment of the targeted component.

How can I verify that the update is installed?
Customers wanting to ensure the client has been updated can run the MDE Client Analyzer on the device. When running the analyzer on a Windows device that does not have the security update, the analyzer will present a warning (ID 121035) indicating missing patch and directing to relevant online article. Additionally, if the update is installed, but the Anti-Spoofing capability is not in a stable state, the analyzer will present warning (ID 121036) indicating an issue and providing additional online guidance or callout to reach out to Microsoft support if issue persists.

Where can I get more information?
For more information, please see the blog post here.

Security updates
101.60.93 — https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/linux-updates?view=o365-worldwide
101.60.91 — https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-updates?view=o365-worldwide
1.0.3011.0302 — https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mtd?view=o365-worldwide
10.0.19042.1586 — https://support.microsoft.com/help/5011487
10.0.18363.2158 — https://support.microsoft.com/help/5011485
10.0.22000.556 — https://support.microsoft.com/help/5011493
10.0.20348.587 — https://support.microsoft.com/help/5011497
10.0.20348.580 — https://support.microsoft.com/help/5011580
10.0.17763.2686 — https://support.microsoft.com/help/5011503
10.8047.22439 — https://support.microsoft.com/en-us/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac

Vulnerabilities 1

Revision history

  1. #4

    Updated links to security updates. This is an informational change only.

  2. #3

    Added links to updates for Microsoft Defender for Endpoint for iOS and Microsoft Defender for Endpoint for Android. Customers that are running these products should ensure that they have received the updates.

  3. #2

    Information added to the Security Updates table for Windows Servers 2012 R2 and 2016. Removed rows for Windows 10, Windows 7, Windows 8.1, and Windows Server 2008 R2. Updated FAQ regarding available security updates. More information regarding Windows Servers 2012 R2 and 2016 is available here: [Microsoft Defender for Endpoint update for EDR Sensor](https://support.microsoft.com/en-us/topic/microsoft-defender-for-endpoint-update-for-edr-sensor-f8f69773-f17f-420f-91f4-a8e5167284ac).

  4. #1

    Information published.

References