Microsoft · Security update · January 10, 2023

KB5022346: January 2023 security update

KB5022346, released January 10, 2023, fixes 49 CVEs across 5 products. One of them is being exploited (CVE-2023-21674); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV1 publicly disclosed
CVEs closed
49
9 rated Critical
Exploited
1
CVE-2023-21674
Exploitation more likely
4
Microsoft's assessment
Highest EPSS
0.3421
98th percentile

Priority of the 49 CVEs

Patch now 1 Urgent 13 High 30 Routine 5

Applies to

Product
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows RT 8.1
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2023-21674 Windows ALPCElevation of Privilege8.8 0.3421 KEVExploited
Urgent CVE-2023-21552 Microsoft Graphics ComponentElevation of Privilege7.8 0.0354 More likely
Urgent CVE-2023-21543 Windows Layer 2 Tunneling ProtocolRemote Code Execution8.1 0.0177 Exploitation Less Likely
Urgent CVE-2023-21556 Windows Layer 2 Tunneling ProtocolRemote Code Execution8.1 0.0150 Exploitation Less Likely
Urgent CVE-2023-21546 Windows Layer 2 Tunneling ProtocolRemote Code Execution8.1 0.0113 Exploitation Less Likely
Urgent CVE-2023-21555 Windows Layer 2 Tunneling ProtocolRemote Code Execution8.1 0.0113 Exploitation Less Likely
Urgent CVE-2023-21679 Windows Layer 2 Tunneling ProtocolRemote Code Execution8.1 0.0113 Exploitation Less Likely
Urgent CVE-2023-21535 Windows Secure Socket Tunneling Protocol (SSTP)Remote Code Execution8.1 0.0111 Exploitation Less Likely
Urgent CVE-2023-21548 Windows Secure Socket Tunneling Protocol (SSTP)Remote Code Execution8.1 0.0111 Exploitation Less Likely
Urgent CVE-2023-21541 Windows Task SchedulerElevation of Privilege7.8 0.0058 More likely
Urgent CVE-2023-21730 Windows Cryptographic ServicesElevation of Privilege7.8 0.0054 Exploitation Less Likely
Urgent CVE-2023-21726 Windows Credential ManagerElevation of Privilege7.8 0.0046 More likely
Urgent CVE-2023-21532 Microsoft Graphics ComponentElevation of Privilege7.0 0.0046 More likely
Urgent CVE-2023-21561 Windows Cryptographic ServicesElevation of Privilege7.8 0.0045 Exploitation Less Likely
High CVE-2023-21746 Windows NTLMElevation of Privilege7.8 0.0243 Exploitation Less Likely
High CVE-2023-21557 Windows LDAP - Lightweight Directory Access ProtocolDenial of Service7.5 0.0208 Exploitation Less Likely
High CVE-2023-21757 Windows Remote Access Service L2TP DriverDenial of Service7.5 0.0206 Exploitation Less Likely
High CVE-2023-21527 Windows iSCSIDenial of Service7.5 0.0203 Exploitation Less Likely
High CVE-2023-21677 Windows IKE ExtensionDenial of Service7.5 0.0203 Exploitation Less Likely
High CVE-2023-21683 Windows IKE ExtensionDenial of Service7.5 0.0203 Exploitation Less Likely
High CVE-2023-21728 Microsoft Local Security Authority Server (lsasrv)Denial of Service7.5 0.0203 Exploitation Less Likely
High CVE-2023-28297 Windows RPC APIElevation of Privilege8.8 0.0166 Exploitation Less Likely
High CVE-2023-21549 Windows SMBElevation of Privilege8.8 0.0147 DisclosedExploitation Less Likely
High CVE-2023-21681 Microsoft WDAC OLE DB provider for SQLRemote Code Execution8.8 0.0141 Exploitation Less Likely
High CVE-2023-21732 Windows ODBC DriverRemote Code Execution8.8 0.0141 Exploitation Less Likely
Showing 1 to 25 of 49 1Next

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.