Microsoft · Security update · December 12, 2023
KB5033118: December 2023 cumulative update for Windows Server 2022
KB5033118, released December 12, 2023, fixes 18 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent1 publicly disclosed
CVEs closed
18
3 rated Critical
Exploited
0
None reported
Exploitation more likely
6
Vendor assessment
Highest EPSS
0.9282
99th percentile
Priority of the 18 CVEs
Patch now 0
Urgent 7
High 7
Routine 4
Applies to
| Product | Build after install |
|---|---|
| Windows Server 2022 | 20348.2159 |
| Windows Server 2022 (Server Core installation) | 20348.2159 |
CVEs this fix closes
| Priority | CVE | Component | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2023-35628 | Windows MSHTML Platform | Remote Code Execution | 8.1 | 0.9282 | More likely |
| Urgent | CVE-2023-36005 | Windows Telephony Server | Elevation of Privilege | 7.5 | 0.2386 | More likely |
| Urgent | CVE-2023-35641 | Windows Internet Connection Sharing (ICS) | Remote Code Execution | 8.8 | 0.0722 | More likely |
| Urgent | CVE-2023-35644 | Windows Kernel-Mode Drivers | Elevation of Privilege | 7.8 | 0.0625 | More likely |
| Urgent | CVE-2023-35630 | Windows Internet Connection Sharing (ICS) | Remote Code Execution | 8.8 | 0.0613 | Exploitation Less Likely |
| Urgent | CVE-2023-36696 | Windows Cloud Files Mini Filter Driver | Elevation of Privilege | 7.8 | 0.0086 | More likely |
| Urgent | CVE-2023-36011 | Windows Win32K | Elevation of Privilege | 7.8 | 0.0071 | More likely |
| High | CVE-2023-35638 | Windows DHCP Server | Denial of Service | 7.5 | 0.0326 | Exploitation Less Likely |
| High | CVE-2023-35643 | Windows DHCP Server | Information Disclosure | 7.5 | 0.0265 | Exploitation Less Likely |
| High | CVE-2023-35639 | Windows ODBC Driver | Remote Code Execution | 8.8 | 0.0237 | Exploitation Less Likely |
| High | CVE-2023-36006 | Microsoft WDAC OLE DB provider for SQL | Remote Code Execution | 8.8 | 0.0189 | Exploitation Less Likely |
| High | CVE-2023-35622 | Microsoft Windows DNS | Spoofing | 7.5 | 0.0156 | Exploitation Less Likely |
| High | CVE-2023-36004 | Windows DPAPI (Data Protection Application Programming Interface) | Spoofing | 7.5 | 0.0137 | Exploitation Less Likely |
| High | CVE-2023-21740 | Windows Media | Remote Code Execution | 7.8 | 0.0109 | Exploitation Less Likely |
| Routine | CVE-2023-20588 | Chipsets | Information Disclosure | 6.0 | 0.1115 | DisclosedExploitation Less Likely |
| Routine | CVE-2023-36003 | XAML Diagnostics | Elevation of Privilege | 6.7 | 0.0285 | Exploitation Less Likely |
| Routine | CVE-2023-36012 | Windows DHCP Server | Information Disclosure | 5.3 | 0.0200 | Exploitation Less Likely |
| Routine | CVE-2023-35642 | Windows Internet Connection Sharing (ICS) | Denial of Service | 6.5 | 0.0128 | Exploitation Less Likely |
Showing 1 to 18 of 18
1