Microsoft · ServicingStack update · January 10, 2023

KB5022303: January 2023 cumulative update for Windows 11 22H2

KB5022303, released January 10, 2023, fixes 66 CVEs across 2 products. One of them is being exploited (CVE-2023-21674); 1 on CISA KEV. Patch Radar priority: Patch now. The product is no longer supported.

Patch now1 on CISA KEV1 publicly disclosedUnsupported product
CVEs closed
66
10 rated Critical
Exploited
1
CVE-2023-21674
Exploitation more likely
6
Vendor assessment
Highest EPSS
0.9253
99th percentile

Priority of the 66 CVEs

Patch now 1 Urgent 16 High 38 Routine 11

Applies to

ProductBuild after install
Windows 11 Version 22H2 for ARM64-based Systems22621.1105
Windows 11 Version 22H2 for x64-based Systems22621.1105

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2023-21674 Windows ALPC Elevation of Privilege 8.8 0.3421 KEVExploited
Urgent CVE-2023-21768 Windows Ancillary Function Driver for WinSock Elevation of Privilege 7.8 0.6542 More likely
Urgent CVE-2022-41113 Microsoft Graphics Component Elevation of Privilege 7.8 0.0813 More likely
Urgent CVE-2023-21552 Microsoft Graphics Component Elevation of Privilege 7.8 0.0354 More likely
Urgent CVE-2023-21543 Windows Layer 2 Tunneling Protocol Remote Code Execution 8.1 0.0177 Exploitation Less Likely
Urgent CVE-2023-21556 Windows Layer 2 Tunneling Protocol Remote Code Execution 8.1 0.0150 Exploitation Less Likely
Urgent CVE-2023-21546 Windows Layer 2 Tunneling Protocol Remote Code Execution 8.1 0.0113 Exploitation Less Likely
Urgent CVE-2023-21555 Windows Layer 2 Tunneling Protocol Remote Code Execution 8.1 0.0113 Exploitation Less Likely
Urgent CVE-2023-21679 Windows Layer 2 Tunneling Protocol Remote Code Execution 8.1 0.0113 Exploitation Less Likely
Urgent CVE-2023-21535 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution 8.1 0.0111 Exploitation Less Likely
Urgent CVE-2023-21548 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution 8.1 0.0111 Exploitation Less Likely
Urgent CVE-2023-21541 Windows Task Scheduler Elevation of Privilege 7.8 0.0058 More likely
Urgent CVE-2023-21730 Windows Cryptographic Services Elevation of Privilege 7.8 0.0054 Exploitation Less Likely
Urgent CVE-2023-21726 Windows Credential Manager Elevation of Privilege 7.8 0.0046 More likely
Urgent CVE-2023-21532 Microsoft Graphics Component Elevation of Privilege 7.0 0.0046 More likely
Urgent CVE-2023-21551 Windows Cryptographic Services Elevation of Privilege 7.8 0.0045 Exploitation Less Likely
Urgent CVE-2023-21561 Windows Cryptographic Services Elevation of Privilege 7.8 0.0045 Exploitation Less Likely
High CVE-2023-21758 Windows IKE Extension Denial of Service 7.5 0.9253 Exploitation Less Likely
High CVE-2023-21547 Windows Internet Key Exchange (IKE) Protocol Denial of Service 7.5 0.8928 Exploitation Less Likely
High CVE-2023-21752 Windows Backup Engine Elevation of Privilege 7.1 0.0547 Exploitation Less Likely
High CVE-2023-21746 Windows NTLM Elevation of Privilege 7.8 0.0243 Exploitation Less Likely
High CVE-2023-21557 Windows LDAP - Lightweight Directory Access Protocol Denial of Service 7.5 0.0208 Exploitation Less Likely
High CVE-2023-21757 Windows Remote Access Service L2TP Driver Denial of Service 7.5 0.0206 Exploitation Less Likely
High CVE-2023-21527 Windows iSCSI Denial of Service 7.5 0.0203 Exploitation Less Likely
High CVE-2023-21677 Windows IKE Extension Denial of Service 7.5 0.0203 Exploitation Less Likely
Showing 1 to 25 of 66 1Next