Microsoft · Security update · September 13, 2016

KB3189866: September 2016 cumulative update for Windows 10 1607

KB3189866, released September 13, 2016, fixes 27 CVEs across 6 products. One of them is being exploited (CVE-2016-3351); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEVKnown ransomware use2 publicly disclosed
CVEs closed
27
4 rated Critical
Exploited
1
CVE-2016-3351
Exploitation more likely
8
Vendor assessment
Highest EPSS
0.7148
99th percentile

Priority of the 27 CVEs

Patch now 1 Urgent 9 High 8 Routine 9

Applies to

Product
Internet Explorer 11 on Windows 10 Version 1607 for 32-bit Systems
Internet Explorer 11 on Windows 10 Version 1607 for x64-based Systems
Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for 32-bit Systems
Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2016-3351 Microsoft Browsers Information Disclosure n/a 0.2648 KEVRansomwareExploited
Urgent CVE-2016-3374 Microsoft Windows PDF Information Disclosure 3.1 0.2585 More likely
Urgent CVE-2016-3370 Microsoft Windows PDF Information Disclosure 3.1 0.2218 More likely
Urgent CVE-2016-3352 Microsoft Windows Information Disclosure 6.5 0.2079 DisclosedMore likely
Urgent CVE-2016-3356 Microsoft Graphics Component Remote Code Execution 6.7 0.1907 Exploitation Less Likely
Urgent CVE-2016-3375 Internet Explorer Remote Code Execution 7.5 0.1702 More likely
Urgent CVE-2016-3377 Microsoft Edge (HTML-based) Remote Code Execution n/a 0.1588 More likely
Urgent CVE-2016-3350 Microsoft Edge (HTML-based) Remote Code Execution n/a 0.1532 More likely
Urgent CVE-2016-3295 Microsoft Browsers Remote Code Execution n/a 0.1499 More likely
Urgent CVE-2016-3292 Internet Explorer Elevation of Privilege 8.8 0.0711 More likely
High CVE-2016-3325 Microsoft Browsers Information Disclosure n/a 0.5391 Exploitation Less Likely
High CVE-2016-3368 Microsoft Windows Remote Code Execution 7.5 0.1833 Exploitation Less Likely
High CVE-2016-3348 Microsoft Graphics Component Elevation of Privilege 7.8 0.1295 N/A
High CVE-2016-3302 Windows Lock Screen Elevation of Privilege 7.0 0.0236 Exploitation Unlikely
High CVE-2016-3355 Microsoft Graphics Component Elevation of Privilege 7.8 0.0233 Exploitation Less Likely
High CVE-2016-3306 Windows Kernel Elevation of Privilege 7.8 0.0231 Exploitation Less Likely
High CVE-2016-3305 Windows Kernel Elevation of Privilege 7.8 0.0146 Exploitation Less Likely
High CVE-2016-3346 Microsoft Windows Elevation of Privilege 7.8 0.0136 DisclosedExploitation Less Likely
Routine CVE-2016-3247 Microsoft Browsers Remote Code Execution 4.2 0.7148 Exploitation Less Likely
Routine CVE-2016-3371 Windows Kernel Elevation of Privilege 6.8 0.4007 Exploitation Less Likely
Routine CVE-2016-3345 Windows SMB Server Denial of Service 5.0 0.3246 Exploitation Unlikely
Routine CVE-2016-3324 Internet Explorer Remote Code Execution 6.0 0.2833 Exploitation Less Likely
Routine CVE-2016-3297 Microsoft Browsers Remote Code Execution 4.2 0.2257 Exploitation Less Likely
Routine CVE-2016-3373 Windows Kernel Elevation of Privilege 6.8 0.1747 Exploitation Less Likely
Routine CVE-2016-3354 Microsoft Graphics Component Information Disclosure 3.3 0.1420 N/A
Showing 1 to 25 of 27 1Next