Microsoft · Security update · November 9, 2021

KB5007255: November 2021 security update

KB5007255, released November 9, 2021, fixes 17 CVEs across 4 products. 3 of them are being exploited (CVE-2021-42287); 3 on CISA KEV. Patch Radar priority: Patch now.

Patch now3 on CISA KEVKnown ransomware use2 publicly disclosed
CVEs closed
17
1 rated Critical
Exploited
3
CVE-2021-42287
Exploitation more likely
1
Vendor assessment
Highest EPSS
0.7717
99th percentile

Priority of the 17 CVEs

Patch now 3 Urgent 1 High 10 Routine 3

Applies to

Product
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2021-42287 Windows Active Directory Elevation of Privilege 7.5 0.7717 KEVRansomwareExploited
Patch now CVE-2021-42278 Windows Active Directory Elevation of Privilege 7.5 0.7330 KEVRansomwareExploited
Patch now CVE-2021-41379 Windows Installer Elevation of Privilege 5.5 0.1945 KEVRansomwareExploited
Urgent CVE-2021-38666 Windows RDP Remote Code Execution 8.8 0.1518 More likely
High CVE-2021-38665 Windows RDP Information Disclosure 7.4 0.0702 Exploitation Less Likely
High CVE-2021-42282 Windows Active Directory Elevation of Privilege 7.5 0.0417 Exploitation Less Likely
High CVE-2021-42291 Windows Active Directory Elevation of Privilege 7.5 0.0417 Exploitation Less Likely
High CVE-2021-42275 Windows COM Remote Code Execution 8.8 0.0210 Exploitation Less Likely
High CVE-2021-42285 Windows Kernel Elevation of Privilege 7.8 0.0055 Exploitation Less Likely
High CVE-2021-42283 Windows NTFS Elevation of Privilege 8.8 0.0049 Exploitation Less Likely
High CVE-2021-41366 Windows Cred SSProvider Protocol Elevation of Privilege 7.8 0.0049 Exploitation Less Likely
High CVE-2021-41367 Windows NTFS Elevation of Privilege 7.8 0.0049 Exploitation Less Likely
High CVE-2021-41370 Windows NTFS Elevation of Privilege 7.8 0.0049 Exploitation Less Likely
High CVE-2021-41377 Windows Fast FAT Driver Elevation of Privilege 7.8 0.0049 Exploitation Less Likely
Routine CVE-2021-42284 Role: Windows Hyper-V Denial of Service 6.8 0.0376 Exploitation Less Likely
Routine CVE-2021-38631 Windows RDP Information Disclosure 4.4 0.0188 DisclosedExploitation Less Likely
Routine CVE-2021-41371 Windows RDP Information Disclosure 4.4 0.0165 DisclosedExploitation Less Likely
Showing 1 to 17 of 17 1