KB5022842: Windows Server 2022 Cumulative Update (February 2023)

CVE-2023-23376 (CLFS Driver EoP) combined with any code execution vulnerability allows attackers to immediately escalate to SYSTEM. This combination was observed in multiple ransomware deployments in January-February 2023. CVE-2023-21823 (Graphics Component) provides unauthenticated remote code execution on systems rendering attacker-controlled content.

KB5022842 patches three actively exploited zero-days in February 2023: CVE-2023-21823 (Windows Graphics Component RCE, requiring no privileges), CVE-2023-23376 (CLFS Driver EoP used by ransomware operators), and CVE-2023-21715 (Office Publisher security feature bypass). All three were confirmed exploited in the wild before the patch was released.

Probably yes if any of these apply:

The CLFS driver zero-day CVE-2023-23376 was observed by Microsoft in multiple ransomware attack chains during early 2023. Attackers would gain initial access via phishing, then use the CLFS driver vulnerability to escalate to SYSTEM, disable endpoint protection, and deploy ransomware — a pattern consistent with multiple threat actor groups including those behind Cl0p and LockBit ransomware.