# KB5022291: January 2023 cumulative update for Windows Server 2022 KB5022291, released January 10, 2023, fixes 63 CVEs across 2 products. One of them is being exploited (CVE-2023-21674); 1 on CISA KEV. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/fix/microsoft/kb5022291 - Platform: Microsoft - Released: Jan 10, 2023 - Priority: Patch now (Closes CVE-2023-21674, exploited (CISA KEV)) - CVEs: 63, exploited: 1, on CISA KEV: 1 - Vendor advisory: https://support.microsoft.com/help/5022291 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Windows Server 2022](https://patchblox.com/security/data/product/microsoft/windows-server-2022.md) | | 20348.1487 | | [Windows Server 2022 (Server Core installation)](https://patchblox.com/security/data/product/microsoft/windows-server-2022-server-core-installation.md) | | 20348.1487 | ## CVEs this fix closes | CVE | Priority | Component | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2023-21674](https://patchblox.com/security/data/cve/CVE-2023-21674.md) | Patch now | Windows ALPC | 8.8 | 0.3421 | CISA KEV | | [CVE-2023-21768](https://patchblox.com/security/data/cve/CVE-2023-21768.md) | Urgent | Windows Ancillary Function Driver for WinSock | 7.8 | 0.6542 | More likely | | [CVE-2022-41113](https://patchblox.com/security/data/cve/CVE-2022-41113.md) | Urgent | Microsoft Graphics Component | 7.8 | 0.0813 | More likely | | [CVE-2023-21552](https://patchblox.com/security/data/cve/CVE-2023-21552.md) | Urgent | Microsoft Graphics Component | 7.8 | 0.0354 | More likely | | [CVE-2023-21543](https://patchblox.com/security/data/cve/CVE-2023-21543.md) | Urgent | Windows Layer 2 Tunneling Protocol | 8.1 | 0.0177 | | | [CVE-2023-21556](https://patchblox.com/security/data/cve/CVE-2023-21556.md) | Urgent | Windows Layer 2 Tunneling Protocol | 8.1 | 0.0150 | | | [CVE-2023-21546](https://patchblox.com/security/data/cve/CVE-2023-21546.md) | Urgent | Windows Layer 2 Tunneling Protocol | 8.1 | 0.0113 | | | [CVE-2023-21555](https://patchblox.com/security/data/cve/CVE-2023-21555.md) | Urgent | Windows Layer 2 Tunneling Protocol | 8.1 | 0.0113 | | | [CVE-2023-21679](https://patchblox.com/security/data/cve/CVE-2023-21679.md) | Urgent | Windows Layer 2 Tunneling Protocol | 8.1 | 0.0113 | | | [CVE-2023-21535](https://patchblox.com/security/data/cve/CVE-2023-21535.md) | Urgent | Windows Secure Socket Tunneling Protocol (SSTP) | 8.1 | 0.0111 | | | [CVE-2023-21548](https://patchblox.com/security/data/cve/CVE-2023-21548.md) | Urgent | Windows Secure Socket Tunneling Protocol (SSTP) | 8.1 | 0.0111 | | | [CVE-2023-21541](https://patchblox.com/security/data/cve/CVE-2023-21541.md) | Urgent | Windows Task Scheduler | 7.8 | 0.0058 | More likely | | [CVE-2023-21730](https://patchblox.com/security/data/cve/CVE-2023-21730.md) | Urgent | Windows Cryptographic Services | 7.8 | 0.0054 | | | [CVE-2023-21726](https://patchblox.com/security/data/cve/CVE-2023-21726.md) | Urgent | Windows Credential Manager | 7.8 | 0.0046 | More likely | | [CVE-2023-21532](https://patchblox.com/security/data/cve/CVE-2023-21532.md) | Urgent | Microsoft Graphics Component | 7.0 | 0.0046 | More likely | | [CVE-2023-21551](https://patchblox.com/security/data/cve/CVE-2023-21551.md) | Urgent | Windows Cryptographic Services | 7.8 | 0.0045 | | | [CVE-2023-21561](https://patchblox.com/security/data/cve/CVE-2023-21561.md) | Urgent | Windows Cryptographic Services | 7.8 | 0.0045 | | | [CVE-2023-21758](https://patchblox.com/security/data/cve/CVE-2023-21758.md) | High | Windows IKE Extension | 7.5 | 0.9253 | | | [CVE-2023-21547](https://patchblox.com/security/data/cve/CVE-2023-21547.md) | High | Windows Internet Key Exchange (IKE) Protocol | 7.5 | 0.8928 | | | [CVE-2023-21746](https://patchblox.com/security/data/cve/CVE-2023-21746.md) | High | Windows NTLM | 7.8 | 0.0243 | | | [CVE-2023-21557](https://patchblox.com/security/data/cve/CVE-2023-21557.md) | High | Windows LDAP - Lightweight Directory Access Protocol | 7.5 | 0.0208 | | | [CVE-2023-21757](https://patchblox.com/security/data/cve/CVE-2023-21757.md) | High | Windows Remote Access Service L2TP Driver | 7.5 | 0.0206 | | | [CVE-2023-21527](https://patchblox.com/security/data/cve/CVE-2023-21527.md) | High | Windows iSCSI | 7.5 | 0.0203 | | | [CVE-2023-21677](https://patchblox.com/security/data/cve/CVE-2023-21677.md) | High | Windows IKE Extension | 7.5 | 0.0203 | | | [CVE-2023-21683](https://patchblox.com/security/data/cve/CVE-2023-21683.md) | High | Windows IKE Extension | 7.5 | 0.0203 | | | [CVE-2023-21728](https://patchblox.com/security/data/cve/CVE-2023-21728.md) | High | Microsoft Local Security Authority Server (lsasrv) | 7.5 | 0.0203 | | | [CVE-2023-28297](https://patchblox.com/security/data/cve/CVE-2023-28297.md) | High | Windows RPC API | 8.8 | 0.0166 | | | [CVE-2023-21676](https://patchblox.com/security/data/cve/CVE-2023-21676.md) | High | Windows LDAP - Lightweight Directory Access Protocol | 8.8 | 0.0155 | | | [CVE-2023-21549](https://patchblox.com/security/data/cve/CVE-2023-21549.md) | High | Windows SMB | 8.8 | 0.0147 | Disclosed | | [CVE-2023-21681](https://patchblox.com/security/data/cve/CVE-2023-21681.md) | High | Microsoft WDAC OLE DB provider for SQL | 8.8 | 0.0141 | | | [CVE-2023-21732](https://patchblox.com/security/data/cve/CVE-2023-21732.md) | High | Windows ODBC Driver | 8.8 | 0.0141 | | | [CVE-2023-21539](https://patchblox.com/security/data/cve/CVE-2023-21539.md) | High | Windows Authentication Methods | 7.5 | 0.0120 | | | [CVE-2023-21675](https://patchblox.com/security/data/cve/CVE-2023-21675.md) | High | Windows Virtual Registry Provider | 7.8 | 0.0085 | | | [CVE-2023-21747](https://patchblox.com/security/data/cve/CVE-2023-21747.md) | High | Windows Virtual Registry Provider | 7.8 | 0.0085 | | | [CVE-2023-21748](https://patchblox.com/security/data/cve/CVE-2023-21748.md) | High | Windows Virtual Registry Provider | 7.8 | 0.0085 | | | [CVE-2023-21749](https://patchblox.com/security/data/cve/CVE-2023-21749.md) | High | Windows Virtual Registry Provider | 7.8 | 0.0083 | | | [CVE-2023-21772](https://patchblox.com/security/data/cve/CVE-2023-21772.md) | High | Windows Virtual Registry Provider | 7.8 | 0.0074 | | | [CVE-2023-21774](https://patchblox.com/security/data/cve/CVE-2023-21774.md) | High | Windows Virtual Registry Provider | 7.8 | 0.0074 | | | [CVE-2023-21750](https://patchblox.com/security/data/cve/CVE-2023-21750.md) | High | Windows Virtual Registry Provider | 7.1 | 0.0073 | | | [CVE-2023-21773](https://patchblox.com/security/data/cve/CVE-2023-21773.md) | High | Windows Virtual Registry Provider | 7.8 | 0.0072 | | | [CVE-2023-21678](https://patchblox.com/security/data/cve/CVE-2023-21678.md) | High | Windows Print Spooler Components | 7.8 | 0.0060 | | | [CVE-2023-21760](https://patchblox.com/security/data/cve/CVE-2023-21760.md) | High | Windows Print Spooler Components | 7.1 | 0.0055 | | | [CVE-2023-21537](https://patchblox.com/security/data/cve/CVE-2023-21537.md) | High | Windows Message Queuing | 7.8 | 0.0054 | | | [CVE-2023-21724](https://patchblox.com/security/data/cve/CVE-2023-21724.md) | High | Windows DWM Core Library | 7.8 | 0.0051 | | | [CVE-2023-21680](https://patchblox.com/security/data/cve/CVE-2023-21680.md) | High | Microsoft Graphics Component | 7.8 | 0.0049 | | | [CVE-2023-21765](https://patchblox.com/security/data/cve/CVE-2023-21765.md) | High | Windows Print Spooler Components | 7.8 | 0.0048 | | | [CVE-2023-21558](https://patchblox.com/security/data/cve/CVE-2023-21558.md) | High | Windows Error Reporting | 7.8 | 0.0047 | | | [CVE-2023-21754](https://patchblox.com/security/data/cve/CVE-2023-21754.md) | High | Windows Management Instrumentation | 7.8 | 0.0047 | | | [CVE-2023-21767](https://patchblox.com/security/data/cve/CVE-2023-21767.md) | High | Windows Overlay Filter | 7.8 | 0.0047 | | | [CVE-2023-21524](https://patchblox.com/security/data/cve/CVE-2023-21524.md) | High | Windows Local Security Authority (LSA) | 7.8 | 0.0041 | | | [CVE-2023-21771](https://patchblox.com/security/data/cve/CVE-2023-21771.md) | High | Windows Local Session Manager (LSM) | 7.0 | 0.0041 | | | [CVE-2023-21733](https://patchblox.com/security/data/cve/CVE-2023-21733.md) | High | Windows Bind Filter Driver | 7.0 | 0.0030 | | | [CVE-2023-21525](https://patchblox.com/security/data/cve/CVE-2023-21525.md) | Routine | Windows RPC API | 5.3 | 0.0155 | | | [CVE-2023-21563](https://patchblox.com/security/data/cve/CVE-2023-21563.md) | Routine | Windows BitLocker | 6.8 | 0.0150 | | | [CVE-2023-21682](https://patchblox.com/security/data/cve/CVE-2023-21682.md) | Routine | Windows Point-to-Point Tunneling Protocol | 5.3 | 0.0141 | | | [CVE-2023-21560](https://patchblox.com/security/data/cve/CVE-2023-21560.md) | Routine | Windows Boot Manager | 6.6 | 0.0117 | | | [CVE-2023-21776](https://patchblox.com/security/data/cve/CVE-2023-21776.md) | Routine | Windows Virtual Registry Provider | 5.5 | 0.0104 | | | [CVE-2023-21766](https://patchblox.com/security/data/cve/CVE-2023-21766.md) | Routine | Windows Overlay Filter | 4.7 | 0.0090 | | | [CVE-2023-21759](https://patchblox.com/security/data/cve/CVE-2023-21759.md) | Routine | Windows Smart Card | 3.3 | 0.0061 | | | [CVE-2023-21540](https://patchblox.com/security/data/cve/CVE-2023-21540.md) | Routine | Windows Cryptographic Services | 5.5 | 0.0060 | | | [CVE-2023-21550](https://patchblox.com/security/data/cve/CVE-2023-21550.md) | Routine | Windows Cryptographic Services | 5.5 | 0.0060 | | | [CVE-2023-21559](https://patchblox.com/security/data/cve/CVE-2023-21559.md) | Routine | Windows Cryptographic Services | 5.5 | 0.0060 | | | [CVE-2023-21536](https://patchblox.com/security/data/cve/CVE-2023-21536.md) | Routine | Windows Event Tracing | 4.7 | 0.0041 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo