# KB5040434: July 2024 cumulative update for Windows 10 1607 KB5040434, released July 9, 2024, fixes 83 CVEs across 6 products. 2 of them are being exploited (CVE-2024-38112); 1 on CISA KEV. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/fix/microsoft/kb5040434 - Platform: Microsoft - Released: Jul 9, 2024 - Priority: Patch now (Closes CVE-2024-38112, exploited (CISA KEV)) - CVEs: 83, exploited: 2, on CISA KEV: 1 - Vendor advisory: https://support.microsoft.com/help/5040434 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1607 for 32-bit Systems](https://patchblox.com/security/data/product/microsoft/microsoft-.net-framework-3.5-and-4.7.2-on-windows-10-version-1607-for-32-bit-systems.md) | | 14393.7159 | | [Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1607 for x64-based Systems](https://patchblox.com/security/data/product/microsoft/microsoft-.net-framework-3.5-and-4.7.2-on-windows-10-version-1607-for-x64-based-systems.md) | | 14393.7159 | | [Windows 10 Version 1607 for 32-bit Systems](https://patchblox.com/security/data/product/microsoft/windows-10-version-1607-for-32-bit-systems.md) | | 14393.7159 | | [Windows 10 Version 1607 for x64-based Systems](https://patchblox.com/security/data/product/microsoft/windows-10-version-1607-for-x64-based-systems.md) | | 14393.7159 | | [Windows Server 2016](https://patchblox.com/security/data/product/microsoft/windows-server-2016.md) | | 14393.7159 | | [Windows Server 2016 (Server Core installation)](https://patchblox.com/security/data/product/microsoft/windows-server-2016-server-core-installation.md) | | 14393.7159 | ## CVEs this fix closes | CVE | Priority | Component | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2024-38112](https://patchblox.com/security/data/cve/CVE-2024-38112.md) | Patch now | Windows MSHTML Platform | 7.5 | 0.8423 | CISA KEV | | [CVE-2023-24932](https://patchblox.com/security/data/cve/CVE-2023-24932.md) | Patch now | Windows Secure Boot | 6.7 | 0.1182 | Exploited, Disclosed | | [CVE-2024-38077](https://patchblox.com/security/data/cve/CVE-2024-38077.md) | Urgent | Windows Remote Desktop Licensing Service | 9.8 | 0.8423 | | | [CVE-2024-38060](https://patchblox.com/security/data/cve/CVE-2024-38060.md) | Urgent | Windows Imaging Component | 8.8 | 0.1591 | More likely | | [CVE-2024-38054](https://patchblox.com/security/data/cve/CVE-2024-38054.md) | Urgent | Microsoft Streaming Service | 7.8 | 0.1042 | More likely | | [CVE-2024-38052](https://patchblox.com/security/data/cve/CVE-2024-38052.md) | Urgent | Microsoft Streaming Service | 7.8 | 0.0697 | More likely | | [CVE-2024-38085](https://patchblox.com/security/data/cve/CVE-2024-38085.md) | Urgent | Windows Win32 Kernel Subsystem | 7.8 | 0.0526 | More likely | | [CVE-2024-38100](https://patchblox.com/security/data/cve/CVE-2024-38100.md) | Urgent | Windows COM Session | 7.8 | 0.0452 | More likely | | [CVE-2024-38074](https://patchblox.com/security/data/cve/CVE-2024-38074.md) | Urgent | Windows Remote Desktop Licensing Service | 9.8 | 0.0219 | | | [CVE-2024-38076](https://patchblox.com/security/data/cve/CVE-2024-38076.md) | Urgent | Windows Remote Desktop | 9.8 | 0.0215 | | | [CVE-2024-38099](https://patchblox.com/security/data/cve/CVE-2024-38099.md) | Urgent | Windows Remote Desktop Licensing Service | 5.9 | 0.0128 | More likely | | [CVE-2024-38066](https://patchblox.com/security/data/cve/CVE-2024-38066.md) | Urgent | Windows Win32K - GRFX | 7.8 | 0.0086 | More likely | | [CVE-2024-38079](https://patchblox.com/security/data/cve/CVE-2024-38079.md) | Urgent | Microsoft Graphics Component | 7.8 | 0.0071 | More likely | | [CVE-2024-39684](https://patchblox.com/security/data/cve/CVE-2024-39684.md) | Urgent | Active Directory Rights Management Services | 7.8 | 0.0042 | More likely | | [CVE-2024-38071](https://patchblox.com/security/data/cve/CVE-2024-38071.md) | High | Windows Remote Desktop Licensing Service | 7.5 | 0.3585 | | | [CVE-2024-30081](https://patchblox.com/security/data/cve/CVE-2024-30081.md) | High | Windows NTLM | 7.1 | 0.2381 | | | [CVE-2024-3596](https://patchblox.com/security/data/cve/CVE-2024-3596.md) | High | NPS RADIUS Server | 9.0 | 0.1486 | | | [CVE-2024-38031](https://patchblox.com/security/data/cve/CVE-2024-38031.md) | High | Windows Online Certificate Status Protocol (OCSP) | 7.5 | 0.0252 | | | [CVE-2024-38067](https://patchblox.com/security/data/cve/CVE-2024-38067.md) | High | Windows Online Certificate Status Protocol (OCSP) | 7.5 | 0.0252 | | | [CVE-2024-38068](https://patchblox.com/security/data/cve/CVE-2024-38068.md) | High | Windows Online Certificate Status Protocol (OCSP) | 7.5 | 0.0252 | | | [CVE-2024-38073](https://patchblox.com/security/data/cve/CVE-2024-38073.md) | High | Windows Remote Desktop Licensing Service | 7.5 | 0.0248 | | | [CVE-2024-38015](https://patchblox.com/security/data/cve/CVE-2024-38015.md) | High | Windows Remote Desktop | 7.5 | 0.0242 | | | [CVE-2024-38064](https://patchblox.com/security/data/cve/CVE-2024-38064.md) | High | Windows TCP/IP | 7.5 | 0.0220 | | | [CVE-2024-38072](https://patchblox.com/security/data/cve/CVE-2024-38072.md) | High | Windows Remote Desktop Licensing Service | 7.5 | 0.0216 | | | [CVE-2024-38044](https://patchblox.com/security/data/cve/CVE-2024-38044.md) | High | Windows DHCP Server | 7.2 | 0.0213 | | | [CVE-2024-38025](https://patchblox.com/security/data/cve/CVE-2024-38025.md) | High | Windows Performance Monitor | 7.2 | 0.0207 | | | [CVE-2024-38028](https://patchblox.com/security/data/cve/CVE-2024-38028.md) | High | Windows Performance Monitor | 7.2 | 0.0207 | | | [CVE-2024-38091](https://patchblox.com/security/data/cve/CVE-2024-38091.md) | High | Microsoft WS-Discovery | 7.5 | 0.0189 | | | [CVE-2024-38104](https://patchblox.com/security/data/cve/CVE-2024-38104.md) | High | Windows Fax and Scan Service | 8.8 | 0.0182 | | | [CVE-2024-38019](https://patchblox.com/security/data/cve/CVE-2024-38019.md) | High | Windows Performance Monitor | 7.2 | 0.0178 | | | [CVE-2024-38062](https://patchblox.com/security/data/cve/CVE-2024-38062.md) | High | Windows Kernel-Mode Drivers | 7.8 | 0.0161 | | | [CVE-2024-30013](https://patchblox.com/security/data/cve/CVE-2024-30013.md) | High | Windows MultiPoint Services | 8.8 | 0.0160 | | | [CVE-2024-38061](https://patchblox.com/security/data/cve/CVE-2024-38061.md) | High | Role: Active Directory Certificate Services; Active Directory Domain Services | 7.5 | 0.0150 | | | [CVE-2024-37969](https://patchblox.com/security/data/cve/CVE-2024-37969.md) | High | Windows Secure Boot | 8.0 | 0.0136 | | | [CVE-2024-37971](https://patchblox.com/security/data/cve/CVE-2024-37971.md) | High | Windows Secure Boot | 8.0 | 0.0136 | | | [CVE-2024-38081](https://patchblox.com/security/data/cve/CVE-2024-38081.md) | High | .NET and Visual Studio | 7.3 | 0.0130 | | | [CVE-2024-37975](https://patchblox.com/security/data/cve/CVE-2024-37975.md) | High | Windows Secure Boot | 8.0 | 0.0126 | | | [CVE-2024-37987](https://patchblox.com/security/data/cve/CVE-2024-37987.md) | High | Windows Secure Boot | 8.0 | 0.0126 | | | [CVE-2024-38011](https://patchblox.com/security/data/cve/CVE-2024-38011.md) | High | Windows Secure Boot | 8.0 | 0.0126 | | | [CVE-2024-38184](https://patchblox.com/security/data/cve/CVE-2024-38184.md) | High | Windows Kernel-Mode Drivers | 7.8 | 0.0117 | | | [CVE-2024-28899](https://patchblox.com/security/data/cve/CVE-2024-28899.md) | High | Windows Secure Boot | 8.8 | 0.0116 | | | [CVE-2024-38053](https://patchblox.com/security/data/cve/CVE-2024-38053.md) | High | Windows Internet Connection Sharing (ICS) | 8.8 | 0.0115 | | | [CVE-2024-38051](https://patchblox.com/security/data/cve/CVE-2024-38051.md) | High | Microsoft Graphics Component | 7.8 | 0.0112 | | | [CVE-2024-38185](https://patchblox.com/security/data/cve/CVE-2024-38185.md) | High | Windows Kernel-Mode Drivers | 7.8 | 0.0111 | | | [CVE-2024-38187](https://patchblox.com/security/data/cve/CVE-2024-38187.md) | High | Windows Kernel-Mode Drivers | 7.8 | 0.0111 | | | [CVE-2024-37970](https://patchblox.com/security/data/cve/CVE-2024-37970.md) | High | Windows Secure Boot | 8.0 | 0.0106 | | | [CVE-2024-38033](https://patchblox.com/security/data/cve/CVE-2024-38033.md) | High | Windows PowerShell | 7.3 | 0.0106 | | | [CVE-2024-37972](https://patchblox.com/security/data/cve/CVE-2024-37972.md) | High | Windows Secure Boot | 8.0 | 0.0098 | | | [CVE-2024-37974](https://patchblox.com/security/data/cve/CVE-2024-37974.md) | High | Windows Secure Boot | 8.0 | 0.0098 | | | [CVE-2024-37986](https://patchblox.com/security/data/cve/CVE-2024-37986.md) | High | Windows Secure Boot | 8.0 | 0.0098 | | | [CVE-2024-37988](https://patchblox.com/security/data/cve/CVE-2024-37988.md) | High | Windows Secure Boot | 8.0 | 0.0098 | | | [CVE-2024-37989](https://patchblox.com/security/data/cve/CVE-2024-37989.md) | High | Windows Secure Boot | 8.0 | 0.0098 | | | [CVE-2024-38010](https://patchblox.com/security/data/cve/CVE-2024-38010.md) | High | Windows Secure Boot | 8.0 | 0.0098 | | | [CVE-2024-38186](https://patchblox.com/security/data/cve/CVE-2024-38186.md) | High | Windows Kernel-Mode Drivers | 7.8 | 0.0084 | | | [CVE-2024-38034](https://patchblox.com/security/data/cve/CVE-2024-38034.md) | High | Windows Filtering | 7.8 | 0.0076 | | | [CVE-2024-38057](https://patchblox.com/security/data/cve/CVE-2024-38057.md) | High | Microsoft Streaming Service | 7.8 | 0.0076 | | | [CVE-2024-37984](https://patchblox.com/security/data/cve/CVE-2024-37984.md) | High | Windows Secure Boot | 8.4 | 0.0075 | | | [CVE-2024-38050](https://patchblox.com/security/data/cve/CVE-2024-38050.md) | High | Windows Workstation Service | 7.8 | 0.0071 | | | [CVE-2024-38070](https://patchblox.com/security/data/cve/CVE-2024-38070.md) | High | Windows LockDown Policy (WLDP) | 7.8 | 0.0071 | | | [CVE-2024-38043](https://patchblox.com/security/data/cve/CVE-2024-38043.md) | High | Windows PowerShell | 7.8 | 0.0069 | | | [CVE-2024-38047](https://patchblox.com/security/data/cve/CVE-2024-38047.md) | High | Windows PowerShell | 7.8 | 0.0067 | | | [CVE-2024-30079](https://patchblox.com/security/data/cve/CVE-2024-30079.md) | High | Windows Remote Access Connection Manager | 7.8 | 0.0066 | | | [CVE-2024-37973](https://patchblox.com/security/data/cve/CVE-2024-37973.md) | High | Windows Secure Boot | 8.8 | 0.0065 | | | [CVE-2024-38022](https://patchblox.com/security/data/cve/CVE-2024-38022.md) | High | Windows Image Acquisition | 7.0 | 0.0057 | | | [CVE-2024-38191](https://patchblox.com/security/data/cve/CVE-2024-38191.md) | High | Windows Kernel-Mode Drivers | 7.8 | 0.0051 | | | [CVE-2024-38517](https://patchblox.com/security/data/cve/CVE-2024-38517.md) | High | Active Directory Rights Management Services | 7.8 | 0.0038 | | | [CVE-2024-38069](https://patchblox.com/security/data/cve/CVE-2024-38069.md) | High | Windows Enroll Engine | 7.0 | 0.0033 | | | [CVE-2024-38030](https://patchblox.com/security/data/cve/CVE-2024-38030.md) | Routine | Windows Themes | 6.5 | 0.5110 | | | [CVE-2024-38041](https://patchblox.com/security/data/cve/CVE-2024-38041.md) | Routine | Windows Kernel | 5.5 | 0.0216 | | | [CVE-2024-38049](https://patchblox.com/security/data/cve/CVE-2024-38049.md) | Routine | Windows Distributed Transaction Coordinator | 6.6 | 0.0155 | | | [CVE-2024-38027](https://patchblox.com/security/data/cve/CVE-2024-38027.md) | Routine | Line Printer Daemon Service (LPD) | 6.5 | 0.0101 | | | [CVE-2024-38048](https://patchblox.com/security/data/cve/CVE-2024-38048.md) | Routine | NDIS | 6.5 | 0.0101 | | | [CVE-2024-38058](https://patchblox.com/security/data/cve/CVE-2024-38058.md) | Routine | Windows BitLocker | 6.8 | 0.0093 | | | [CVE-2024-38017](https://patchblox.com/security/data/cve/CVE-2024-38017.md) | Routine | Windows Message Queuing | 5.5 | 0.0093 | | | [CVE-2024-38065](https://patchblox.com/security/data/cve/CVE-2024-38065.md) | Routine | Windows Secure Boot | 6.8 | 0.0092 | | | [CVE-2024-35270](https://patchblox.com/security/data/cve/CVE-2024-35270.md) | Routine | Windows iSCSI | 5.3 | 0.0086 | | | [CVE-2024-38101](https://patchblox.com/security/data/cve/CVE-2024-38101.md) | Routine | Windows Internet Connection Sharing (ICS) | 6.5 | 0.0085 | | | [CVE-2024-38102](https://patchblox.com/security/data/cve/CVE-2024-38102.md) | Routine | Windows Internet Connection Sharing (ICS) | 6.5 | 0.0085 | | | [CVE-2024-38105](https://patchblox.com/security/data/cve/CVE-2024-38105.md) | Routine | Windows Layer-2 Bridge Network Driver | 6.5 | 0.0085 | | | [CVE-2024-38055](https://patchblox.com/security/data/cve/CVE-2024-38055.md) | Routine | Microsoft Windows Codecs Library | 5.5 | 0.0079 | | | [CVE-2024-38056](https://patchblox.com/security/data/cve/CVE-2024-38056.md) | Routine | Microsoft Windows Codecs Library | 5.5 | 0.0079 | | | [CVE-2024-38013](https://patchblox.com/security/data/cve/CVE-2024-38013.md) | Routine | Windows Server Backup | 6.7 | 0.0063 | | | [CVE-2024-30071](https://patchblox.com/security/data/cve/CVE-2024-30071.md) | Routine | Windows Remote Access Connection Manager | 4.7 | 0.0058 | | --- Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.