# KB5012599: April 2022 cumulative update for Windows 10 20H2 KB5012599, released April 12, 2022, fixes 96 CVEs across 9 products. 2 of them are being exploited (CVE-2022-26904); 2 on CISA KEV. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/fix/microsoft/kb5012599 - Platform: Microsoft - Released: Apr 12, 2022 - Priority: Patch now (Closes CVE-2022-26904, exploited (CISA KEV)) - CVEs: 96, exploited: 2, on CISA KEV: 2 - Vendor advisory: https://support.microsoft.com/help/5012599 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Windows 10 Version 20H2 for 32-bit Systems](https://patchblox.com/security/data/product/microsoft/windows-10-version-20h2-for-32-bit-systems.md) | | | | [Windows 10 Version 20H2 for ARM64-based Systems](https://patchblox.com/security/data/product/microsoft/windows-10-version-20h2-for-arm64-based-systems.md) | | | | [Windows 10 Version 21H1 for 32-bit Systems](https://patchblox.com/security/data/product/microsoft/windows-10-version-21h1-for-32-bit-systems.md) | | | | [Windows 10 Version 21H1 for ARM64-based Systems](https://patchblox.com/security/data/product/microsoft/windows-10-version-21h1-for-arm64-based-systems.md) | | | | [Windows 10 Version 21H1 for x64-based Systems](https://patchblox.com/security/data/product/microsoft/windows-10-version-21h1-for-x64-based-systems.md) | | | | [Windows 10 Version 21H2 for 32-bit Systems](https://patchblox.com/security/data/product/microsoft/windows-10-version-21h2-for-32-bit-systems.md) | | | | [Windows 10 Version 21H2 for ARM64-based Systems](https://patchblox.com/security/data/product/microsoft/windows-10-version-21h2-for-arm64-based-systems.md) | | | | [Windows 10 Version 21H2 for x64-based Systems](https://patchblox.com/security/data/product/microsoft/windows-10-version-21h2-for-x64-based-systems.md) | | | | [Windows Server, version 20H2 (Server Core Installation)](https://patchblox.com/security/data/product/microsoft/windows-server-version-20h2-server-core-installation.md) | | | ## CVEs this fix closes | CVE | Priority | Component | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2022-26904](https://patchblox.com/security/data/cve/CVE-2022-26904.md) | Patch now | Windows User Profile Service | 7.0 | 0.1695 | CISA KEV, Disclosed | | [CVE-2022-24521](https://patchblox.com/security/data/cve/CVE-2022-24521.md) | Patch now | Windows Common Log File System Driver | 7.8 | 0.0713 | CISA KEV, Ransomware | | [CVE-2022-26809](https://patchblox.com/security/data/cve/CVE-2022-26809.md) | Urgent | Windows Remote Procedure Call Runtime | 9.8 | 0.9086 | More likely | | [CVE-2022-24500](https://patchblox.com/security/data/cve/CVE-2022-24500.md) | Urgent | Windows SMB | 8.8 | 0.3805 | | | [CVE-2022-24497](https://patchblox.com/security/data/cve/CVE-2022-24497.md) | Urgent | Windows Network File System | 9.8 | 0.3479 | More likely | | [CVE-2022-24491](https://patchblox.com/security/data/cve/CVE-2022-24491.md) | Urgent | Windows Network File System | 9.8 | 0.3347 | More likely | | [CVE-2022-24481](https://patchblox.com/security/data/cve/CVE-2022-24481.md) | Urgent | Windows Common Log File System Driver | 7.8 | 0.1678 | More likely | | [CVE-2022-24542](https://patchblox.com/security/data/cve/CVE-2022-24542.md) | Urgent | Windows Win32K | 7.8 | 0.0915 | More likely | | [CVE-2022-24474](https://patchblox.com/security/data/cve/CVE-2022-24474.md) | Urgent | Windows Win32K | 7.8 | 0.0651 | More likely | | [CVE-2022-24547](https://patchblox.com/security/data/cve/CVE-2022-24547.md) | Urgent | Windows Media | 7.8 | 0.0603 | More likely | | [CVE-2022-24541](https://patchblox.com/security/data/cve/CVE-2022-24541.md) | Urgent | Windows SMB | 8.8 | 0.0305 | | | [CVE-2022-26919](https://patchblox.com/security/data/cve/CVE-2022-26919.md) | Urgent | Windows LDAP - Lightweight Directory Access Protocol | 8.1 | 0.0257 | | | [CVE-2022-24546](https://patchblox.com/security/data/cve/CVE-2022-24546.md) | Urgent | Windows DWM Core Library | 7.8 | 0.0082 | More likely | | [CVE-2022-26914](https://patchblox.com/security/data/cve/CVE-2022-26914.md) | Urgent | Windows Win32K | 7.8 | 0.0082 | More likely | | [CVE-2022-23257](https://patchblox.com/security/data/cve/CVE-2022-23257.md) | Urgent | Role: Windows Hyper-V | 8.8 | 0.0063 | | | [CVE-2022-22008](https://patchblox.com/security/data/cve/CVE-2022-22008.md) | Urgent | Role: Windows Hyper-V | 7.8 | 0.0042 | | | [CVE-2022-24537](https://patchblox.com/security/data/cve/CVE-2022-24537.md) | Urgent | Role: Windows Hyper-V | 7.8 | 0.0037 | | | [CVE-2022-24533](https://patchblox.com/security/data/cve/CVE-2022-24533.md) | High | Windows RDP | 8.0 | 0.0560 | | | [CVE-2022-26826](https://patchblox.com/security/data/cve/CVE-2022-26826.md) | High | Role: DNS Server | 7.2 | 0.0405 | | | [CVE-2022-24536](https://patchblox.com/security/data/cve/CVE-2022-24536.md) | High | Role: DNS Server | 7.2 | 0.0384 | | | [CVE-2022-26812](https://patchblox.com/security/data/cve/CVE-2022-26812.md) | High | Role: DNS Server | 7.2 | 0.0384 | | | [CVE-2022-26813](https://patchblox.com/security/data/cve/CVE-2022-26813.md) | High | Role: DNS Server | 7.2 | 0.0384 | | | [CVE-2022-26815](https://patchblox.com/security/data/cve/CVE-2022-26815.md) | High | Role: DNS Server | 7.2 | 0.0384 | | | [CVE-2022-26811](https://patchblox.com/security/data/cve/CVE-2022-26811.md) | High | Role: DNS Server | 7.2 | 0.0358 | | | [CVE-2022-26825](https://patchblox.com/security/data/cve/CVE-2022-26825.md) | High | Role: DNS Server | 7.2 | 0.0358 | | | [CVE-2022-26915](https://patchblox.com/security/data/cve/CVE-2022-26915.md) | High | Windows SChannel | 7.5 | 0.0356 | | | [CVE-2022-26823](https://patchblox.com/security/data/cve/CVE-2022-26823.md) | High | Role: DNS Server | 7.2 | 0.0352 | | | [CVE-2022-26824](https://patchblox.com/security/data/cve/CVE-2022-26824.md) | High | Role: DNS Server | 7.2 | 0.0352 | | | [CVE-2022-24490](https://patchblox.com/security/data/cve/CVE-2022-24490.md) | High | Role: Windows Hyper-V | 8.1 | 0.0333 | | | [CVE-2022-26831](https://patchblox.com/security/data/cve/CVE-2022-26831.md) | High | Windows LDAP - Lightweight Directory Access Protocol | 7.5 | 0.0327 | | | [CVE-2022-24492](https://patchblox.com/security/data/cve/CVE-2022-24492.md) | High | Windows Remote Procedure Call Runtime | 8.8 | 0.0309 | | | [CVE-2022-24539](https://patchblox.com/security/data/cve/CVE-2022-24539.md) | High | Role: Windows Hyper-V | 8.1 | 0.0302 | | | [CVE-2022-26903](https://patchblox.com/security/data/cve/CVE-2022-26903.md) | High | Microsoft Graphics Component | 7.8 | 0.0266 | | | [CVE-2022-24528](https://patchblox.com/security/data/cve/CVE-2022-24528.md) | High | Windows Remote Procedure Call Runtime | 8.8 | 0.0258 | | | [CVE-2022-24487](https://patchblox.com/security/data/cve/CVE-2022-24487.md) | High | Windows Local Security Authority Subsystem Service (LSASS) | 8.8 | 0.0222 | | | [CVE-2022-24545](https://patchblox.com/security/data/cve/CVE-2022-24545.md) | High | Windows Kerberos | 8.1 | 0.0221 | | | [CVE-2022-26916](https://patchblox.com/security/data/cve/CVE-2022-26916.md) | High | Windows Fax Compose Form | 7.8 | 0.0206 | | | [CVE-2022-26917](https://patchblox.com/security/data/cve/CVE-2022-26917.md) | High | Windows Fax Compose Form | 7.8 | 0.0206 | | | [CVE-2022-26918](https://patchblox.com/security/data/cve/CVE-2022-26918.md) | High | Windows Fax Compose Form | 7.8 | 0.0206 | | | [CVE-2022-21983](https://patchblox.com/security/data/cve/CVE-2022-21983.md) | High | Windows kernel32.dll | 7.5 | 0.0205 | | | [CVE-2022-24494](https://patchblox.com/security/data/cve/CVE-2022-24494.md) | High | Windows Ancillary Function Driver for WinSock | 7.8 | 0.0191 | | | [CVE-2022-24534](https://patchblox.com/security/data/cve/CVE-2022-24534.md) | High | Windows kernel32.dll | 7.5 | 0.0190 | | | [CVE-2022-24485](https://patchblox.com/security/data/cve/CVE-2022-24485.md) | High | Windows kernel32.dll | 7.5 | 0.0170 | | | [CVE-2022-24495](https://patchblox.com/security/data/cve/CVE-2022-24495.md) | High | Microsoft Windows Media Foundation | 7.0 | 0.0134 | | | [CVE-2022-24499](https://patchblox.com/security/data/cve/CVE-2022-24499.md) | High | Windows Installer | 7.8 | 0.0100 | | | [CVE-2022-24479](https://patchblox.com/security/data/cve/CVE-2022-24479.md) | High | Windows Feedback Hub | 7.8 | 0.0095 | | | [CVE-2022-24550](https://patchblox.com/security/data/cve/CVE-2022-24550.md) | High | Windows Telephony Server | 7.8 | 0.0088 | | | [CVE-2022-26798](https://patchblox.com/security/data/cve/CVE-2022-26798.md) | High | Windows Print Spooler Components | 7.8 | 0.0085 | | | [CVE-2022-26803](https://patchblox.com/security/data/cve/CVE-2022-26803.md) | High | Windows Print Spooler Components | 7.8 | 0.0085 | | | [CVE-2022-26787](https://patchblox.com/security/data/cve/CVE-2022-26787.md) | High | Windows Print Spooler Components | 7.8 | 0.0080 | | | [CVE-2022-26792](https://patchblox.com/security/data/cve/CVE-2022-26792.md) | High | Windows Print Spooler Components | 7.8 | 0.0080 | | | [CVE-2022-26796](https://patchblox.com/security/data/cve/CVE-2022-26796.md) | High | Windows Print Spooler Components | 7.8 | 0.0080 | | | [CVE-2022-26801](https://patchblox.com/security/data/cve/CVE-2022-26801.md) | High | Windows Print Spooler Components | 7.8 | 0.0080 | | | [CVE-2022-26802](https://patchblox.com/security/data/cve/CVE-2022-26802.md) | High | Windows Print Spooler Components | 7.8 | 0.0080 | | | [CVE-2022-26786](https://patchblox.com/security/data/cve/CVE-2022-26786.md) | High | Windows Print Spooler Components | 7.8 | 0.0079 | | | [CVE-2022-26789](https://patchblox.com/security/data/cve/CVE-2022-26789.md) | High | Windows Print Spooler Components | 7.8 | 0.0077 | | | [CVE-2022-26791](https://patchblox.com/security/data/cve/CVE-2022-26791.md) | High | Windows Print Spooler Components | 7.8 | 0.0077 | | | [CVE-2022-26790](https://patchblox.com/security/data/cve/CVE-2022-26790.md) | High | Windows Print Spooler Components | 7.8 | 0.0071 | | | [CVE-2022-26794](https://patchblox.com/security/data/cve/CVE-2022-26794.md) | High | Windows Print Spooler Components | 7.8 | 0.0071 | | | [CVE-2022-26797](https://patchblox.com/security/data/cve/CVE-2022-26797.md) | High | Windows Print Spooler Components | 7.8 | 0.0071 | | | [CVE-2022-26793](https://patchblox.com/security/data/cve/CVE-2022-26793.md) | High | Windows Print Spooler Components | 7.8 | 0.0068 | | | [CVE-2022-24544](https://patchblox.com/security/data/cve/CVE-2022-24544.md) | High | Windows Kerberos | 7.8 | 0.0068 | | | [CVE-2022-26788](https://patchblox.com/security/data/cve/CVE-2022-26788.md) | High | Windows PowerShell | 7.8 | 0.0065 | | | [CVE-2022-24488](https://patchblox.com/security/data/cve/CVE-2022-24488.md) | High | Windows App Store | 7.8 | 0.0065 | | | [CVE-2022-24496](https://patchblox.com/security/data/cve/CVE-2022-24496.md) | High | Windows Local Security Authority Subsystem Service (LSASS) | 7.8 | 0.0065 | | | [CVE-2022-26810](https://patchblox.com/security/data/cve/CVE-2022-26810.md) | High | Windows File Server | 7.8 | 0.0060 | | | [CVE-2022-26795](https://patchblox.com/security/data/cve/CVE-2022-26795.md) | High | Windows Print Spooler Components | 7.8 | 0.0060 | | | [CVE-2022-22009](https://patchblox.com/security/data/cve/CVE-2022-22009.md) | High | Role: Windows Hyper-V | 7.8 | 0.0057 | | | [CVE-2022-24530](https://patchblox.com/security/data/cve/CVE-2022-24530.md) | High | Windows Installer | 7.8 | 0.0055 | | | [CVE-2022-24549](https://patchblox.com/security/data/cve/CVE-2022-24549.md) | High | Windows AppX Package Manager | 7.8 | 0.0054 | | | [CVE-2022-24486](https://patchblox.com/security/data/cve/CVE-2022-24486.md) | High | Windows Kerberos | 7.8 | 0.0053 | | | [CVE-2022-24489](https://patchblox.com/security/data/cve/CVE-2022-24489.md) | High | Windows Cluster Client Failover | 7.8 | 0.0050 | | | [CVE-2022-26808](https://patchblox.com/security/data/cve/CVE-2022-26808.md) | High | Windows File Explorer | 7.0 | 0.0043 | | | [CVE-2022-24540](https://patchblox.com/security/data/cve/CVE-2022-24540.md) | High | Windows ALPC | 7.0 | 0.0041 | | | [CVE-2022-26827](https://patchblox.com/security/data/cve/CVE-2022-26827.md) | High | Windows File Server | 7.0 | 0.0041 | | | [CVE-2022-26828](https://patchblox.com/security/data/cve/CVE-2022-26828.md) | High | Microsoft Bluetooth Driver | 7.0 | 0.0035 | | | [CVE-2022-26807](https://patchblox.com/security/data/cve/CVE-2022-26807.md) | High | Windows Work Folder Service | 7.0 | 0.0035 | | | [CVE-2022-24482](https://patchblox.com/security/data/cve/CVE-2022-24482.md) | High | Windows ALPC | 7.0 | 0.0033 | | | [CVE-2022-26783](https://patchblox.com/security/data/cve/CVE-2022-26783.md) | Routine | Role: Windows Hyper-V | 6.5 | 0.0280 | | | [CVE-2022-24498](https://patchblox.com/security/data/cve/CVE-2022-24498.md) | Routine | Windows iSCSI Target Service | 6.5 | 0.0257 | | | [CVE-2022-26816](https://patchblox.com/security/data/cve/CVE-2022-26816.md) | Routine | Role: DNS Server | 6.5 | 0.0252 | | | [CVE-2022-24538](https://patchblox.com/security/data/cve/CVE-2022-24538.md) | Routine | Windows Cluster Shared Volume (CSV) | 6.5 | 0.0245 | | | [CVE-2022-26784](https://patchblox.com/security/data/cve/CVE-2022-26784.md) | Routine | Windows Cluster Shared Volume (CSV) | 6.5 | 0.0245 | | | [CVE-2022-26785](https://patchblox.com/security/data/cve/CVE-2022-26785.md) | Routine | Role: Windows Hyper-V | 6.5 | 0.0238 | | | [CVE-2022-26818](https://patchblox.com/security/data/cve/CVE-2022-26818.md) | Routine | Role: DNS Server | 6.6 | 0.0234 | | | [CVE-2022-24483](https://patchblox.com/security/data/cve/CVE-2022-24483.md) | Routine | Windows Kernel | 5.5 | 0.0226 | | | [CVE-2022-26819](https://patchblox.com/security/data/cve/CVE-2022-26819.md) | Routine | Role: DNS Server | 6.6 | 0.0193 | | | [CVE-2022-26820](https://patchblox.com/security/data/cve/CVE-2022-26820.md) | Routine | Role: DNS Server | 6.6 | 0.0193 | | | [CVE-2022-26821](https://patchblox.com/security/data/cve/CVE-2022-26821.md) | Routine | Role: DNS Server | 6.6 | 0.0193 | | | [CVE-2022-26822](https://patchblox.com/security/data/cve/CVE-2022-26822.md) | Routine | Role: DNS Server | 6.6 | 0.0193 | | | [CVE-2022-26829](https://patchblox.com/security/data/cve/CVE-2022-26829.md) | Routine | Role: DNS Server | 6.6 | 0.0193 | | | [CVE-2022-26814](https://patchblox.com/security/data/cve/CVE-2022-26814.md) | Routine | Active Directory Domain Services | 6.6 | 0.0174 | | | [CVE-2022-26817](https://patchblox.com/security/data/cve/CVE-2022-26817.md) | Routine | Active Directory Domain Services | 6.6 | 0.0174 | | | [CVE-2022-26920](https://patchblox.com/security/data/cve/CVE-2022-26920.md) | Routine | Microsoft Graphics Component | 5.5 | 0.0086 | | | [CVE-2022-24493](https://patchblox.com/security/data/cve/CVE-2022-24493.md) | Routine | Microsoft Local Security Authority Server (lsasrv) | 5.5 | 0.0084 | | | [CVE-2022-24484](https://patchblox.com/security/data/cve/CVE-2022-24484.md) | Routine | Windows Cluster Shared Volume (CSV) | 5.5 | 0.0065 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo