Patch days / November 2020

Microsoft Patch Tuesday — November 2020

Tuesday, 10 November 2020

Vulnerabilities: 112
Critical: 1
High: 67
Zero-days: 0
Public exploit: 4

Exploited 1

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

High 7.8
CVE-2020-17087 Exploited Public exploit Windows Kernel Local Elevation of Privilege Vulnerability
EPSS 5.4%

Critical 1

Critical 9.8
CVE-2020-17051 Windows Network File System Remote Code Execution Vulnerability
EPSS 11%

Public exploit code 3

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

High 7.8
CVE-2020-17035 Public exploit Windows Kernel Elevation of Privilege Vulnerability
EPSS 1.4%
High 7.8
CVE-2020-17086 Public exploit Raw Image Extension Remote Code Execution Vulnerability
EPSS 4.6%
High 7.0
CVE-2020-17057 Public exploit Windows Win32k Elevation of Privilege Vulnerability
EPSS 1.9%

All vulnerabilities 112

Critical1 Show

Critical 9.8
CVE-2020-17051 Windows Network File System Remote Code Execution Vulnerability
EPSS 11%

High67 Show

High 7.8
CVE-2020-17087 Exploited Public exploit Windows Kernel Local Elevation of Privilege Vulnerability
EPSS 5.4%
High 8.8
CVE-2020-17042 Windows Print Spooler Remote Code Execution Vulnerability
EPSS 5.1%
High 8.8
CVE-2020-17061 Microsoft SharePoint Remote Code Execution Vulnerability
EPSS 4.3%
High 8.5
CVE-2020-17084 Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 3.9%
High 8.1
CVE-2020-16970 Azure Sphere Unsigned Code Execution Vulnerability
EPSS 1.4%
High 8.0
CVE-2020-17016 Microsoft SharePoint Server Spoofing Vulnerability
EPSS 3.2%
High 7.8
CVE-2020-17035 Public exploit Windows Kernel Elevation of Privilege Vulnerability
EPSS 1.4%
High 7.8
CVE-2020-17086 Public exploit Raw Image Extension Remote Code Execution Vulnerability
EPSS 4.6%
High 7.8
CVE-2020-17001 Windows Print Spooler Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17010 Win32k Elevation of Privilege Vulnerability
EPSS 1.5%
High 7.8
CVE-2020-17011 Windows Port Class Library Elevation of Privilege Vulnerability
EPSS 1%
High 7.8
CVE-2020-17012 Windows Bind Filter Driver Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17014 Windows Print Spooler Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17019 Microsoft Excel Remote Code Execution Vulnerability
EPSS 3.5%
High 7.8
CVE-2020-17024 Windows Client Side Rendering Print Provider Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17025 Windows Remote Access Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17026 Windows Remote Access Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17027 Windows Remote Access Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17028 Windows Remote Access Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17031 Windows Remote Access Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17032 Windows Remote Access Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17033 Windows Remote Access Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17034 Windows Remote Access Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17037 Windows WalletService Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17038 Win32k Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17041 Windows Print Configuration Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17043 Windows Remote Access Elevation of Privilege Vulnerability
EPSS 2.9%
High 7.8
CVE-2020-17044 Windows Remote Access Elevation of Privilege Vulnerability
EPSS 2.9%
High 7.8
CVE-2020-17055 Windows Remote Access Elevation of Privilege Vulnerability
EPSS 2.9%
High 7.8
CVE-2020-17062 Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
EPSS 4.1%
High 7.8
CVE-2020-17064 Microsoft Excel Remote Code Execution Vulnerability
EPSS 3.4%
High 7.8
CVE-2020-17065 Microsoft Excel Remote Code Execution Vulnerability
EPSS 4.1%
High 7.8
CVE-2020-17066 Microsoft Excel Remote Code Execution Vulnerability
EPSS 4.1%
High 7.8
CVE-2020-17067 Microsoft Excel Security Feature Bypass Vulnerability
EPSS 3.3%
High 7.8
CVE-2020-17068 Windows GDI+ Remote Code Execution Vulnerability
High 7.8
CVE-2020-17070 Windows Update Medic Service Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17073 Windows Update Orchestrator Service Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17074 Windows Update Orchestrator Service Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17075 Windows USO Core Worker Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17076 Windows Update Orchestrator Service Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17077 Windows Update Stack Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17078 Raw Image Extension Remote Code Execution Vulnerability
EPSS 3.2%
High 7.8
CVE-2020-17079 Raw Image Extension Remote Code Execution Vulnerability
EPSS 3.1%
High 7.8
CVE-2020-17082 Raw Image Extension Remote Code Execution Vulnerability
EPSS 2.9%
High 7.8
CVE-2020-17088 Windows Common Log File System Driver Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17091 Microsoft Teams Remote Code Execution Vulnerability
EPSS 1.9%
High 7.8
CVE-2020-17101 HEIF Image Extensions Remote Code Execution Vulnerability
High 7.8
CVE-2020-17104 Visual Studio Code JSHint Extension Remote Code Execution Vulnerability
EPSS 3.8%
High 7.8
CVE-2020-17105 AV1 Video Extension Remote Code Execution Vulnerability
EPSS 3.7%
High 7.8
CVE-2020-17106 HEVC Video Extensions Remote Code Execution Vulnerability
EPSS 4%
High 7.8
CVE-2020-17107 HEVC Video Extensions Remote Code Execution Vulnerability
EPSS 4%
High 7.8
CVE-2020-17108 HEVC Video Extensions Remote Code Execution Vulnerability
EPSS 4%
High 7.8
CVE-2020-17109 HEVC Video Extensions Remote Code Execution Vulnerability
EPSS 4.3%
High 7.8
CVE-2020-17110 HEVC Video Extensions Remote Code Execution Vulnerability
EPSS 4%
High 7.7
CVE-2020-16997 Remote Desktop Protocol Server Information Disclosure Vulnerability
EPSS 4%
High 7.5
CVE-2020-16992 Azure Sphere Elevation of Privilege Vulnerability
EPSS 1.4%
High 7.5
CVE-2020-17047 Windows Network File System Denial of Service Vulnerability
EPSS 27%
High 7.5
CVE-2020-17052 Scripting Engine Memory Corruption Vulnerability
EPSS 2.7%
High 7.5
CVE-2020-17053 Internet Explorer Memory Corruption Vulnerability
EPSS 3.2%
High 7.5
CVE-2020-17058 Microsoft Browser Memory Corruption Vulnerability
EPSS 3.1%
High 7.3
CVE-2020-16984 Azure Sphere Unsigned Code Execution Vulnerability
EPSS 1.3%
High 7.3
CVE-2020-16987 Azure Sphere Unsigned Code Execution Vulnerability
EPSS 1.3%
High 7.3
CVE-2020-16991 Azure Sphere Unsigned Code Execution Vulnerability
EPSS 1.7%
High 7.3
CVE-2020-16994 Azure Sphere Unsigned Code Execution Vulnerability
EPSS 1.6%
High 7.0
CVE-2020-17057 Public exploit Windows Win32k Elevation of Privilege Vulnerability
EPSS 1.9%
High 7.0
CVE-2020-16998 DirectX Elevation of Privilege Vulnerability
High 7.0
CVE-2020-17007 Windows Error Reporting Elevation of Privilege Vulnerability

Medium43 Show

Medium 6.9
CVE-2020-16988 Azure Sphere Elevation of Privilege Vulnerability
Medium 6.8
CVE-2020-17063 Microsoft Office Online Spoofing Vulnerability
EPSS 1.6%
Medium 6.6
CVE-2020-17049 Kerberos KDC Security Feature Bypass Vulnerability
EPSS 14%
Medium 6.5
CVE-2020-17040 Windows Hyper-V Security Feature Bypass Vulnerability
EPSS 2.7%
Medium 6.2
CVE-2020-16985 Azure Sphere Information Disclosure Vulnerability
EPSS 1.7%
Medium 6.2
CVE-2020-16986 Azure Sphere Denial of Service Vulnerability
EPSS 1.3%
Medium 6.2
CVE-2020-16990 Azure Sphere Information Disclosure Vulnerability
EPSS 1.5%
Medium 6.2
CVE-2020-17085 Microsoft Exchange Server Denial of Service Vulnerability
EPSS 3.6%
Medium 6.1
CVE-2020-16981 Azure Sphere Elevation of Privilege Vulnerability
Medium 6.1
CVE-2020-16982 Azure Sphere Unsigned Code Execution Vulnerability
EPSS 1.2%
Medium 5.7
CVE-2020-16983 Azure Sphere Tampering Vulnerability
Medium 5.5
CVE-2020-1599 Windows Spoofing Vulnerability
EPSS 19%
Medium 5.5
CVE-2020-16999 Windows WalletService Information Disclosure Vulnerability
EPSS 1.3%
Medium 5.5
CVE-2020-17000 Remote Desktop Protocol Client Information Disclosure Vulnerability
EPSS 1.3%
Medium 5.5
CVE-2020-17004 Windows Graphics Component Information Disclosure Vulnerability
EPSS 1.3%
Medium 5.5
CVE-2020-17013 Win32k Information Disclosure Vulnerability
EPSS 1.3%
Medium 5.5
CVE-2020-17029 Windows Canonical Display Driver Information Disclosure Vulnerability
EPSS 1.4%
Medium 5.5
CVE-2020-17030 Windows MSCTF Server Information Disclosure Vulnerability
EPSS 1.4%
Medium 5.5
CVE-2020-17036 Windows Function Discovery SSDP Provider Information Disclosure Vulnerability
EPSS 1.4%
Medium 5.5
CVE-2020-17045 Windows KernelStream Information Disclosure Vulnerability
EPSS 1.4%
Medium 5.5
CVE-2020-17046 Windows Error Reporting Denial of Service Vulnerability
EPSS 1.5%
Medium 5.5
CVE-2020-17056 Windows Network File System Information Disclosure Vulnerability
EPSS 1.3%
Medium 5.5
CVE-2020-17069 Windows NDIS Information Disclosure Vulnerability
EPSS 1.1%
Medium 5.5
CVE-2020-17071 Windows Delivery Optimization Information Disclosure Vulnerability
EPSS 1.1%
Medium 5.5
CVE-2020-17081 Microsoft Raw Image Extension Information Disclosure Vulnerability
EPSS 3.7%
Medium 5.5
CVE-2020-17083 Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 12%
Medium 5.5
CVE-2020-17100 Visual Studio Tampering Vulnerability
Medium 5.5
CVE-2020-17102 WebP Image Extensions Information Disclosure Vulnerability
EPSS 1.2%
Medium 5.5
CVE-2020-17113 Windows Camera Codec Information Disclosure Vulnerability
EPSS 1.5%
Medium 5.4
CVE-2020-1325 Azure DevOps Server and Team Foundation Services Spoofing Vulnerability
EPSS 1.6%
Medium 5.4
CVE-2020-16989 Azure Sphere Elevation of Privilege Vulnerability
Medium 5.4
CVE-2020-16993 Azure Sphere Elevation of Privilege Vulnerability
Medium 5.4
CVE-2020-17005 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
EPSS 1.4%
Medium 5.4
CVE-2020-17006 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
EPSS 1.4%
Medium 5.4
CVE-2020-17018 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
EPSS 1.4%
Medium 5.4
CVE-2020-17021 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
EPSS 1.4%
Medium 5.4
CVE-2020-17060 Microsoft SharePoint Server Spoofing Vulnerability
EPSS 1.9%
Medium 5.3
CVE-2020-16979 Microsoft SharePoint Information Disclosure Vulnerability
EPSS 3.1%
Medium 5.3
CVE-2020-17017 Microsoft SharePoint Information Disclosure Vulnerability
EPSS 3.8%
Medium 5.3
CVE-2020-17090 Microsoft Defender for Endpoint Security Feature Bypass Vulnerability
EPSS 3.3%
Medium 4.3
CVE-2020-17015 Microsoft SharePoint Server Spoofing Vulnerability
EPSS 2%
Medium 4.2
CVE-2020-17048 Chakra Scripting Engine Memory Corruption Vulnerability
EPSS 1.6%
Medium 4.2
CVE-2020-17054 Chakra Scripting Engine Memory Corruption Vulnerability
EPSS 2.1%

Low1 Show

Low 3.3
CVE-2020-17020 Microsoft Word Security Feature Bypass Vulnerability
EPSS 1.3%