Microsoft issues emergency Windows patch for PrintNightmare vulnerability [Updated]

What you need to know

• Microsoft released a critical emergency Windows patch that addresses the PrintNightmare vulnerability.
• If exploited, the vulnerability allows attackers to install programs, create new accounts, and create, view, or delete data.
• The patch is available for Windows 10, Windows 8.1, Windows 7, and multiple versions of Windows Server.

Update July 7, 2021 at 5:05 pm ET: Individuals are finding ways to get around Microsoft's patch, meaning PrintNightmare vulnerabilities remain an active issue. This article's text has been updated to reflect new information.

Microsoft has issued a critical emergency patch for a flaw in the Windows Print Spooler service. The vulnerability is known as PrintNightmare. When exploited, it allows attackers to "install programs; view, change, or delete data; or create new accounts with full user rights," according to Microsoft. The problem is, reports are coming in indicating that the patch doesn't actually fix the entire issue (see below).

The security patch is available for several versions of Windows 10, Windows 8.1, Windows Server 2019, Windows Server 20212 R2, Windows Server 2008, and Windows RT 8.1. It's also available for Windows 7, which is surprising considering the operating system is out of support.

Updates for Windows 10 version 1607, Windows Server 2016, and Windows Server 2012 are not available at this time but will be released soon, according to Microsoft.

PrintNightmare was revealed after researchers published a proof-of-concept exploit, seemingly by accident.

Microsoft's executive summary of the vulnerability includes the following update (emphasis added):

The fact the patch is available for Windows 7 indicates the severity of the issue since Windows 7 has been out of support since January 14, 2020. However, there's one major problem with Microsoft's efforts: They aren't enough to stop the threat.

Security researcher Matthew Hickey stated that Microsoft's fix only patches up one element of the vulnerability (via BleepingComputer).

Via local privilege escalation, threat actors can still target vulnerabilities. Worse yet, according to other reports, there are ways for individuals to bypass Microsoft's patch entirely and target vulnerable systems via remote code execution in addition to the aforementioned local privilege execution.

0patch has released a patch that it claims is capable of defending against the problems Microsoft's official patch cannot. However, installing Microsoft's July 6 patch will disable 0patch's benefits, so you'll have to go with one or the other.