Microsoft · Security update · May 9, 2023
KB5026361: May 2023 cumulative update for Windows 10 20H2
KB5026361, released May 9, 2023, fixes 21 CVEs across 8 products. One of them is being exploited (CVE-2023-24932). Patch Radar priority: Patch now.
Patch now2 publicly disclosed
CVEs closed
21
4 rated Critical
Exploited
1
CVE-2023-24932
Exploitation more likely
3
Vendor assessment
Highest EPSS
0.8389
99th percentile
Priority of the 21 CVEs
Patch now 1
Urgent 6
High 10
Routine 4
Applies to
CVEs this fix closes
| Priority | CVE | Component | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Patch now | CVE-2023-24932 | Windows Secure Boot | Security Feature Bypass | 6.7 | 0.1182 | DisclosedExploited |
| Urgent | CVE-2023-29325 | Windows OLE | Remote Code Execution | 8.1 | 0.8389 | DisclosedMore likely |
| Urgent | CVE-2023-24949 | Windows Kernel | Elevation of Privilege | 7.8 | 0.2462 | More likely |
| Urgent | CVE-2023-24943 | Windows PGM | Remote Code Execution | 9.8 | 0.0468 | Exploitation Less Likely |
| Urgent | CVE-2023-29324 | Windows MSHTML Platform | Security Feature Bypass | 6.5 | 0.0284 | More likely |
| Urgent | CVE-2023-28283 | Windows LDAP - Lightweight Directory Access Protocol | Remote Code Execution | 8.1 | 0.0097 | Exploitation Less Likely |
| Urgent | CVE-2023-24903 | Windows Secure Socket Tunneling Protocol (SSTP) | Remote Code Execution | 8.1 | 0.0092 | Exploitation Less Likely |
| High | CVE-2023-24940 | Windows PGM | Denial of Service | 7.5 | 0.0517 | Exploitation Less Likely |
| High | CVE-2023-24939 | Windows NFS Portmapper | Denial of Service | 7.5 | 0.0466 | Exploitation Less Likely |
| High | CVE-2022-29900 | AMD CPU Branch | Information Disclosure | 7.8 | 0.0394 | Exploitation Less Likely |
| High | CVE-2023-24942 | Windows Remote Procedure Call Runtime | Denial of Service | 7.5 | 0.0190 | Exploitation Less Likely |
| High | CVE-2023-24901 | Windows NFS Portmapper | Information Disclosure | 7.5 | 0.0159 | Exploitation Less Likely |
| High | CVE-2023-24948 | Microsoft Bluetooth Driver | Elevation of Privilege | 7.4 | 0.0095 | Exploitation Less Likely |
| High | CVE-2022-26928 | Windows Photo Import API | Elevation of Privilege | 7.0 | 0.0079 | Exploitation Less Likely |
| High | CVE-2023-24947 | Microsoft Bluetooth Driver | Remote Code Execution | 8.8 | 0.0070 | Exploitation Less Likely |
| High | CVE-2023-24905 | Remote Desktop Client | Remote Code Execution | 7.8 | 0.0067 | Exploitation Less Likely |
| High | CVE-2023-24946 | Windows Backup Engine | Elevation of Privilege | 7.8 | 0.0044 | Exploitation Less Likely |
| Routine | CVE-2023-24900 | Windows NTLM | Information Disclosure | 5.9 | 0.0123 | Exploitation Less Likely |
| Routine | CVE-2023-24944 | Microsoft Bluetooth Driver | Information Disclosure | 6.5 | 0.0069 | Exploitation Less Likely |
| Routine | CVE-2023-24945 | Windows iSCSI Target Service | Information Disclosure | 5.5 | 0.0056 | Exploitation Less Likely |
| Routine | CVE-2023-28251 | Windows Secure Boot | Security Feature Bypass | 5.5 | 0.0045 | Exploitation Less Likely |
Showing 1 to 21 of 21
1