# KB5018457: October 2022 security update KB5018457, released October 11, 2022, fixes 48 CVEs across 2 products. 2 of them are being exploited (CVE-2022-38028); 2 on CISA KEV. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/fix/microsoft/kb5018457 - Platform: Microsoft - Released: Oct 11, 2022 - Priority: Patch now (Closes CVE-2022-38028, exploited (CISA KEV)) - CVEs: 48, exploited: 2, on CISA KEV: 2 - Vendor advisory: https://support.microsoft.com/help/5018457 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Windows Server 2012](https://patchblox.com/security/data/product/microsoft/windows-server-2012.md) | | | | [Windows Server 2012 (Server Core installation)](https://patchblox.com/security/data/product/microsoft/windows-server-2012-server-core-installation.md) | | | ## CVEs this fix closes | CVE | Priority | Component | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2022-38028](https://patchblox.com/security/data/cve/CVE-2022-38028.md) | Patch now | Windows Print Spooler Components | 7.8 | 0.1495 | CISA KEV | | [CVE-2022-41033](https://patchblox.com/security/data/cve/CVE-2022-41033.md) | Patch now | Windows COM+ Event System Service | 7.8 | 0.0189 | CISA KEV | | [CVE-2022-37989](https://patchblox.com/security/data/cve/CVE-2022-37989.md) | Urgent | Client Server Run-time Subsystem (CSRSS) | 7.8 | 0.0933 | More likely | | [CVE-2022-37987](https://patchblox.com/security/data/cve/CVE-2022-37987.md) | Urgent | Client Server Run-time Subsystem (CSRSS) | 7.8 | 0.0910 | More likely | | [CVE-2022-38051](https://patchblox.com/security/data/cve/CVE-2022-38051.md) | Urgent | Microsoft Graphics Component | 7.8 | 0.0732 | More likely | | [CVE-2022-37976](https://patchblox.com/security/data/cve/CVE-2022-37976.md) | Urgent | Role: Active Directory Certificate Services; Active Directory Domain Services | 8.8 | 0.0239 | | | [CVE-2022-41081](https://patchblox.com/security/data/cve/CVE-2022-41081.md) | Urgent | Windows Point-to-Point Tunneling Protocol | 8.1 | 0.0195 | | | [CVE-2022-38000](https://patchblox.com/security/data/cve/CVE-2022-38000.md) | Urgent | Windows Point-to-Point Tunneling Protocol | 8.1 | 0.0163 | | | [CVE-2022-22035](https://patchblox.com/security/data/cve/CVE-2022-22035.md) | Urgent | Windows Point-to-Point Tunneling Protocol | 8.1 | 0.0157 | | | [CVE-2022-33634](https://patchblox.com/security/data/cve/CVE-2022-33634.md) | Urgent | Windows Point-to-Point Tunneling Protocol | 8.1 | 0.0147 | | | [CVE-2022-38047](https://patchblox.com/security/data/cve/CVE-2022-38047.md) | Urgent | Windows Point-to-Point Tunneling Protocol | 8.1 | 0.0147 | | | [CVE-2022-24504](https://patchblox.com/security/data/cve/CVE-2022-24504.md) | Urgent | Windows Point-to-Point Tunneling Protocol | 8.1 | 0.0146 | | | [CVE-2022-30198](https://patchblox.com/security/data/cve/CVE-2022-30198.md) | Urgent | Windows Point-to-Point Tunneling Protocol | 8.1 | 0.0146 | | | [CVE-2022-37997](https://patchblox.com/security/data/cve/CVE-2022-37997.md) | Urgent | Microsoft Graphics Component | 7.8 | 0.0068 | More likely | | [CVE-2022-38044](https://patchblox.com/security/data/cve/CVE-2022-38044.md) | High | Windows CD-ROM Driver | 7.8 | 0.5627 | | | [CVE-2022-38034](https://patchblox.com/security/data/cve/CVE-2022-38034.md) | High | Windows Workstation Service | 8.8 | 0.0400 | | | [CVE-2022-38045](https://patchblox.com/security/data/cve/CVE-2022-38045.md) | High | Windows Server Service | 8.8 | 0.0281 | | | [CVE-2022-33645](https://patchblox.com/security/data/cve/CVE-2022-33645.md) | High | Windows TCP/IP | 7.5 | 0.0267 | | | [CVE-2022-38041](https://patchblox.com/security/data/cve/CVE-2022-38041.md) | High | Windows Secure Channel | 7.5 | 0.0261 | | | [CVE-2022-37982](https://patchblox.com/security/data/cve/CVE-2022-37982.md) | High | Microsoft WDAC OLE DB provider for SQL | 8.8 | 0.0202 | | | [CVE-2022-38031](https://patchblox.com/security/data/cve/CVE-2022-38031.md) | High | Microsoft WDAC OLE DB provider for SQL | 8.8 | 0.0202 | | | [CVE-2022-38040](https://patchblox.com/security/data/cve/CVE-2022-38040.md) | High | Windows ODBC Driver | 8.8 | 0.0202 | | | [CVE-2022-37975](https://patchblox.com/security/data/cve/CVE-2022-37975.md) | High | Windows Group Policy | 8.8 | 0.0193 | | | [CVE-2022-37978](https://patchblox.com/security/data/cve/CVE-2022-37978.md) | High | Windows Active Directory Certificate Services | 7.5 | 0.0185 | | | [CVE-2022-38042](https://patchblox.com/security/data/cve/CVE-2022-38042.md) | High | Active Directory Domain Services | 7.1 | 0.0182 | | | [CVE-2022-33635](https://patchblox.com/security/data/cve/CVE-2022-33635.md) | High | Microsoft Graphics Component | 7.8 | 0.0114 | | | [CVE-2022-38038](https://patchblox.com/security/data/cve/CVE-2022-38038.md) | High | Windows Kernel | 7.8 | 0.0112 | | | [CVE-2022-37988](https://patchblox.com/security/data/cve/CVE-2022-37988.md) | High | Windows Kernel | 7.8 | 0.0109 | | | [CVE-2022-37991](https://patchblox.com/security/data/cve/CVE-2022-37991.md) | High | Windows Kernel | 7.8 | 0.0109 | | | [CVE-2022-38037](https://patchblox.com/security/data/cve/CVE-2022-38037.md) | High | Windows Kernel | 7.8 | 0.0107 | | | [CVE-2022-38029](https://patchblox.com/security/data/cve/CVE-2022-38029.md) | High | Windows ALPC | 7.0 | 0.0077 | | | [CVE-2022-37990](https://patchblox.com/security/data/cve/CVE-2022-37990.md) | High | Windows Kernel | 7.8 | 0.0069 | | | [CVE-2022-37993](https://patchblox.com/security/data/cve/CVE-2022-37993.md) | High | Windows Group Policy Preference Client | 7.8 | 0.0065 | | | [CVE-2022-37994](https://patchblox.com/security/data/cve/CVE-2022-37994.md) | High | Windows Group Policy Preference Client | 7.8 | 0.0065 | | | [CVE-2022-37999](https://patchblox.com/security/data/cve/CVE-2022-37999.md) | High | Windows Group Policy Preference Client | 7.8 | 0.0065 | | | [CVE-2022-37986](https://patchblox.com/security/data/cve/CVE-2022-37986.md) | High | Microsoft Graphics Component | 7.8 | 0.0056 | | | [CVE-2022-37984](https://patchblox.com/security/data/cve/CVE-2022-37984.md) | High | Windows WLAN Service | 7.8 | 0.0054 | | | [CVE-2022-38027](https://patchblox.com/security/data/cve/CVE-2022-38027.md) | High | Windows Storage | 7.0 | 0.0043 | | | [CVE-2022-37985](https://patchblox.com/security/data/cve/CVE-2022-37985.md) | Routine | Microsoft Graphics Component | 5.5 | 0.3860 | | | [CVE-2022-37981](https://patchblox.com/security/data/cve/CVE-2022-37981.md) | Routine | Windows Event Logging Service | 4.3 | 0.0289 | | | [CVE-2022-37977](https://patchblox.com/security/data/cve/CVE-2022-37977.md) | Routine | Windows Local Security Authority Subsystem Service (LSASS) | 6.5 | 0.0234 | | | [CVE-2022-38033](https://patchblox.com/security/data/cve/CVE-2022-38033.md) | Routine | Windows Server Remotely Accessible Registry Keys | 6.5 | 0.0209 | | | [CVE-2022-35770](https://patchblox.com/security/data/cve/CVE-2022-35770.md) | Routine | Windows NTLM | 6.5 | 0.0208 | | | [CVE-2022-37965](https://patchblox.com/security/data/cve/CVE-2022-37965.md) | Routine | Remote Access Service Point-to-Point Tunneling Protocol | 5.9 | 0.0191 | | | [CVE-2022-38032](https://patchblox.com/security/data/cve/CVE-2022-38032.md) | Routine | Windows Portable Device Enumerator Service | 6.6 | 0.0071 | | | [CVE-2022-38022](https://patchblox.com/security/data/cve/CVE-2022-38022.md) | Routine | Windows Kernel | 3.3 | 0.0068 | | | [CVE-2022-38026](https://patchblox.com/security/data/cve/CVE-2022-38026.md) | Routine | Windows DHCP Client | 5.5 | 0.0065 | | | [CVE-2022-38043](https://patchblox.com/security/data/cve/CVE-2022-38043.md) | Routine | Windows Security Support Provider Interface | 5.5 | 0.0065 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo