Microsoft · ServicingStack update · March 14, 2023

KB5023706: March 2023 cumulative update for Windows 11 22H2

KB5023706, released March 14, 2023, fixes 55 CVEs across 2 products. One of them is being exploited (CVE-2023-24880); 1 on CISA KEV. Patch Radar priority: Patch now. The product is no longer supported.

Patch now1 on CISA KEVKnown ransomware use1 publicly disclosedUnsupported product
CVEs closed
55
9 rated Critical
Exploited
1
CVE-2023-24880
Exploitation more likely
5
Vendor assessment
Highest EPSS
0.7801
99th percentile

Priority of the 55 CVEs

Patch now 1 Urgent 11 High 33 Routine 10

Applies to

ProductBuild after install
Windows 11 Version 22H2 for ARM64-based Systems22621.1413
Windows 11 Version 22H2 for x64-based Systems22621.1413

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2023-24880 Windows SmartScreen Security Feature Bypass 4.4 0.7801 KEVRansomwareDisclosedExploited
Urgent CVE-2023-23410 Windows HTTP.sys Elevation of Privilege 7.8 0.0795 More likely
Urgent CVE-2023-23416 Windows Cryptographic Services Remote Code Execution 7.8 0.0758 More likely
Urgent CVE-2023-1018 Windows TPM Elevation of Privilege 8.8 0.0555 Exploitation Less Likely
Urgent CVE-2023-23415 Internet Control Message Protocol (ICMP) Remote Code Execution 9.8 0.0348 More likely
Urgent CVE-2023-23392 Windows HTTP Protocol Stack Remote Code Execution 9.8 0.0167 More likely
Urgent CVE-2023-21708 Windows Remote Procedure Call Remote Code Execution 9.8 0.0149 Exploitation Less Likely
Urgent CVE-2023-1017 Windows TPM Elevation of Privilege 8.8 0.0138 Exploitation Less Likely
Urgent CVE-2023-23404 Remote Access Service Point-to-Point Tunneling Protocol Remote Code Execution 8.1 0.0083 Exploitation Less Likely
Urgent CVE-2022-23257 Role: Windows Hyper-V Remote Code Execution 8.8 0.0063 Exploitation Less Likely
Urgent CVE-2023-23411 Role: Windows Hyper-V Denial of Service 6.5 0.0058 Exploitation Less Likely
Urgent CVE-2023-24861 Windows Win32K Elevation of Privilege 7.0 0.0027 More likely
High CVE-2023-24871 Windows Bluetooth Service Remote Code Execution 8.8 0.0322 Exploitation Less Likely
High CVE-2023-24859 Windows Internet Key Exchange (IKE) Protocol Denial of Service 7.5 0.0165 Exploitation Less Likely
High CVE-2023-23388 Microsoft Bluetooth Driver Elevation of Privilege 8.8 0.0157 Exploitation Less Likely
High CVE-2023-24856 Microsoft PostScript Printer Driver Information Disclosure 7.5 0.0150 Exploitation Less Likely
High CVE-2023-24858 Microsoft PostScript Printer Driver Information Disclosure 7.5 0.0143 Exploitation Less Likely
High CVE-2023-24876 Microsoft PostScript Printer Driver Remote Code Execution 8.8 0.0140 Exploitation Less Likely
High CVE-2023-23403 Microsoft Printer Drivers Remote Code Execution 8.8 0.0129 Exploitation Less Likely
High CVE-2023-23406 Microsoft PostScript Printer Driver Remote Code Execution 8.8 0.0129 Exploitation Less Likely
High CVE-2023-23413 Microsoft PostScript Printer Driver Remote Code Execution 8.8 0.0129 Exploitation Less Likely
High CVE-2023-24864 Microsoft PostScript Printer Driver Elevation of Privilege 8.8 0.0129 Exploitation Less Likely
High CVE-2023-24867 Microsoft PostScript Printer Driver Remote Code Execution 8.8 0.0129 Exploitation Less Likely
High CVE-2023-24868 Microsoft PostScript Printer Driver Remote Code Execution 8.8 0.0129 Exploitation Less Likely
High CVE-2023-24872 Microsoft PostScript Printer Driver Remote Code Execution 8.8 0.0129 Exploitation Less Likely
Showing 1 to 25 of 55 1Next