Microsoft · Security update · April 11, 2023

KB5025230: April 2023 cumulative update for Windows Server 2022

KB5025230, released April 11, 2023, fixes 73 CVEs across 2 products. 3 of them are being exploited (CVE-2022-26923); 3 on CISA KEV. Patch Radar priority: Patch now.

Patch now3 on CISA KEVKnown ransomware use1 publicly disclosed

CVEs closed

7 rated Critical

Exploited

CVE-2022-26923

Exploitation more likely

Microsoft's assessment

Highest EPSS

0.9541

99th percentile

Priority of the 73 CVEs

Patch now 3
                                Urgent 11
                                High 38
                                Routine 21

Applies to

Product	Build after install
Windows Server 2022	20348.1668
Windows Server 2022 (Server Core installation)	20348.1668

CVEs this fix closes

Priority	CVE	Component	Impact	CVSS	EPSS	Exploitation
Patch now	CVE-2022-26923	Windows Active Directory	Elevation of Privilege	8.8	0.8350	KEVExploited
Patch now	CVE-2023-28252	Windows Common Log File System Driver	Elevation of Privilege	7.8	0.4889	KEVRansomwareExploited
Patch now	CVE-2023-28229	Windows CNG Key Isolation Service	Elevation of Privilege	7.0	0.0167	KEVExploited
Urgent	CVE-2023-21554	Windows Message Queuing	Remote Code Execution	9.8	0.9541	More likely
Urgent	CVE-2023-28231	Windows DHCP Server	Remote Code Execution	8.8	0.3662	More likely
Urgent	CVE-2023-28219	Windows Layer 2 Tunneling Protocol	Remote Code Execution	8.1	0.1498	More likely
Urgent	CVE-2023-28220	Windows Layer 2 Tunneling Protocol	Remote Code Execution	8.1	0.1498	More likely
Urgent	CVE-2023-28218	Windows Ancillary Function Driver for WinSock	Elevation of Privilege	7.0	0.1240	More likely
Urgent	CVE-2023-28274	Windows Win32K	Elevation of Privilege	7.8	0.0683	More likely
Urgent	CVE-2023-28227	Microsoft Bluetooth Driver	Remote Code Execution	7.5	0.0659	More likely
Urgent	CVE-2023-28266	Windows Common Log File System Driver	Information Disclosure	5.5	0.0436	More likely
Urgent	CVE-2023-24912	Microsoft Graphics Component	Elevation of Privilege	7.8	0.0357	More likely
Urgent	CVE-2023-28250	Windows PGM	Remote Code Execution	9.8	0.0203	Exploitation Less Likely
Urgent	CVE-2023-28232	Windows Point-to-Point Tunneling Protocol	Remote Code Execution	7.5	0.0091	Exploitation Less Likely
High	CVE-2023-28302	Windows Active Directory	Denial of Service	7.5	0.9257	Exploitation Less Likely
High	CVE-2023-21769	Windows Message Queuing	Denial of Service	7.5	0.8867	Exploitation Less Likely
High	CVE-2023-28244	Windows Kerberos	Elevation of Privilege	8.1	0.0292	Exploitation Less Likely
High	CVE-2023-28293	Windows Kernel	Elevation of Privilege	7.8	0.0287	Exploitation Less Likely
High	CVE-2023-24931	Windows Secure Channel	Denial of Service	7.5	0.0203	Exploitation Less Likely
High	CVE-2023-28241	Windows Secure Socket Tunneling Protocol (SSTP)	Denial of Service	7.5	0.0199	Exploitation Less Likely
High	CVE-2023-28217	Windows Network Address Translation (NAT)	Denial of Service	7.5	0.0194	Exploitation Less Likely
High	CVE-2023-28233	Windows Secure Channel	Denial of Service	7.5	0.0173	Exploitation Less Likely
High	CVE-2023-28234	Windows Transport Security Layer (TLS)	Denial of Service	7.5	0.0173	Exploitation Less Likely
High	CVE-2023-21727	Windows RPC API	Remote Code Execution	8.8	0.0164	Exploitation Less Likely
High	CVE-2023-24884	Microsoft Printer Drivers	Remote Code Execution	8.8	0.0164	Exploitation Less Likely

Released the same day

KB5002213
Microsoft Publisher 2013 Service Pack 1 (32-bit editions), Microsoft Publisher 2013 Service Pack 1 (64-bit editions), Microsoft Publisher 2013 Service Pack 1 RT
KB5002221
Microsoft Publisher 2016 (32-bit edition), Microsoft Publisher 2016 (64-bit edition)
KB5002373
Microsoft SharePoint Server 2019
KB5002375
Microsoft SharePoint Server Subscription Edition
KB5002381
Microsoft SharePoint Enterprise Server 2013 Service Pack 1
KB5002383
Microsoft SharePoint Enterprise Server 2013 Service Pack 1, Microsoft SharePoint Foundation 2013 Service Pack 1
KB5002385
Microsoft SharePoint Enterprise Server 2016
KB5023894
Microsoft Dynamics 365 (on-premises) version 9.1
KB5023896
Microsoft Dynamics 365 (on-premises) version 9.0
KB5025221
Windows 10 Version 20H2 for 32-bit Systems, Windows 10 Version 20H2 for ARM64-based Systems, Windows 10 Version 21H2 for 32-bit Systems and 5 more
KB5025224
Windows 11 version 21H2 for ARM64-based Systems, Windows 11 version 21H2 for x64-based Systems
KB5025228
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows Server 2016 and 1 more

Vendor advisory

https://support.microsoft.com/help/5025230

For tools and AI agents

This page as data: JSON · Markdown

Which machines still need it?

Patchblox reads the OS build on every Windows machine, from Intune, ConfigMgr or its own agent, and shows which ones are still below the fixed build.

Get a demo

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.