Microsoft · Security update · May 9, 2023

KB5026368: May 2023 cumulative update for Windows 11 21H2

KB5026368, released May 9, 2023, fixes 21 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: Urgent. The product is no longer supported.

Urgent1 publicly disclosedUnsupported product
CVEs closed
21
4 rated Critical
Exploited
0
None reported
Exploitation more likely
4
Vendor assessment
Highest EPSS
0.8389
99th percentile

Priority of the 21 CVEs

Patch now 0 Urgent 7 High 10 Routine 4

Applies to

ProductBuild after install
Windows 11 version 21H2 for ARM64-based Systems22000.1936
Windows 11 version 21H2 for x64-based Systems22000.1936

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Urgent CVE-2023-29325 Windows OLE Remote Code Execution 8.1 0.8389 DisclosedMore likely
Urgent CVE-2023-24949 Windows Kernel Elevation of Privilege 7.8 0.2462 More likely
Urgent CVE-2023-24902 Windows Win32K Elevation of Privilege 7.8 0.0509 More likely
Urgent CVE-2023-24943 Windows PGM Remote Code Execution 9.8 0.0468 Exploitation Less Likely
Urgent CVE-2023-29324 Windows MSHTML Platform Security Feature Bypass 6.5 0.0284 More likely
Urgent CVE-2023-28283 Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution 8.1 0.0097 Exploitation Less Likely
Urgent CVE-2023-24903 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution 8.1 0.0092 Exploitation Less Likely
High CVE-2023-24940 Windows PGM Denial of Service 7.5 0.0517 Exploitation Less Likely
High CVE-2023-24939 Windows NFS Portmapper Denial of Service 7.5 0.0466 Exploitation Less Likely
High CVE-2022-29900 AMD CPU Branch Information Disclosure 7.8 0.0394 Exploitation Less Likely
High CVE-2023-24942 Windows Remote Procedure Call Runtime Denial of Service 7.5 0.0190 Exploitation Less Likely
High CVE-2023-24901 Windows NFS Portmapper Information Disclosure 7.5 0.0159 Exploitation Less Likely
High CVE-2023-24948 Microsoft Bluetooth Driver Elevation of Privilege 7.4 0.0095 Exploitation Less Likely
High CVE-2022-26928 Windows Photo Import API Elevation of Privilege 7.0 0.0079 Exploitation Less Likely
High CVE-2023-24905 Remote Desktop Client Remote Code Execution 7.8 0.0067 Exploitation Less Likely
High CVE-2023-24946 Windows Backup Engine Elevation of Privilege 7.8 0.0044 Exploitation Less Likely
High CVE-2023-24899 Microsoft Graphics Component Elevation of Privilege 7.0 0.0034 Exploitation Less Likely
Routine CVE-2023-24900 Windows NTLM Information Disclosure 5.9 0.0123 Exploitation Less Likely
Routine CVE-2023-24944 Microsoft Bluetooth Driver Information Disclosure 6.5 0.0069 Exploitation Less Likely
Routine CVE-2023-24945 Windows iSCSI Target Service Information Disclosure 5.5 0.0056 Exploitation Less Likely
Routine CVE-2023-28251 Windows Secure Boot Security Feature Bypass 5.5 0.0045 Exploitation Less Likely
Showing 1 to 21 of 21 1