Windows LSA Spoofing Vulnerability

How could an attacker exploit this vulnerability?
An unauthenticated attacker could call a method on the LSARPC interface and coerce the domain controller to authenticate to the attacker using NTLM. This security update detects anonymous connection attempts in LSARPC and disallows it.
Yes. Please see ADV210003 Mitigating NTLM Relay Attacks on Active Directory Certificate Services (AD CS).
Yes. Please see KB5005413 for more information on the steps that you need to take to protect your system. Please note that the combined CVSS score would be 9.8 when this vulnerability is chained with the noted NTLM Relay Attacks on Active Directory Certificate Services (AD CS).
Yes. This vulnerability affects all servers but domain controllers should be prioritized in terms of applying security updates.
The EFS API OpenEncryptedFileRaw(A/W), often used in backup software, continues to work in all versions of Windows (local and remote), except when backing up to or from a system running Windows Server 2008 SP2. OpenEncryptedFileRaw will no longer work on Windows Server 2008 SP2.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
The attacker must inject themselves into the logical network path between the target and the resource requested by the victim to read or modify network communications. This is called a machine-in-the-middle (MITM) attack.

Security updates
10.0.17763.2928 — https://support.microsoft.com/help/5013941
10.0.18363.2274 — https://support.microsoft.com/help/5013945
10.0.19043.1706 — https://support.microsoft.com/help/5013942
10.0.20348.707 — https://support.microsoft.com/help/5013944
10.0.22000.675 — https://support.microsoft.com/help/5013943
10.0.10240.19297 — https://support.microsoft.com/help/5013963
10.0.14393.5125 — https://support.microsoft.com/help/5013952
6.1.7601.25954 — https://support.microsoft.com/help/5014012
6.1.7601.25954 — https://support.microsoft.com/help/5013999
6.3.9600.20371 — https://support.microsoft.com/help/5014011
6.3.9600.20365 — https://support.microsoft.com/help/5014001
6.3.9600.20367 — https://support.microsoft.com/help/5014025
6.0.6003.21481 — https://support.microsoft.com/help/5014010
6.0.6003.21481 — https://support.microsoft.com/help/5014006
6.2.9200.23714 — https://support.microsoft.com/help/5014017
6.2.9200.23714 — https://support.microsoft.com/help/5014018