Patch days / December 2020

Microsoft Patch Tuesday — December 2020

Tuesday, 8 December 2020

Vulnerabilities: 57
Critical: 2
High: 39
Zero-days: 0
Public exploit: 4

Exploited 1

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

High 8.4
CVE-2020-17144 Exploited Public exploit Microsoft Exchange Remote Code Execution Vulnerability
EPSS 37%

Critical 2

Critical 9.1
CVE-2020-17132 Public exploit Microsoft Exchange Remote Code Execution Vulnerability
EPSS 90%
Critical 9.1
CVE-2020-17142 Microsoft Exchange Remote Code Execution Vulnerability
EPSS 3.4%

Public exploit code 2

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

High 7.8
CVE-2020-17136 Public exploit Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
EPSS 14%
High 7.0
CVE-2020-17103 Public exploit Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
EPSS 30%

All vulnerabilities 57

Critical2 Show

Critical 9.1
CVE-2020-17132 Public exploit Microsoft Exchange Remote Code Execution Vulnerability
EPSS 90%
Critical 9.1
CVE-2020-17142 Microsoft Exchange Remote Code Execution Vulnerability
EPSS 3.4%

High39 Show

High 8.4
CVE-2020-17144 Exploited Public exploit Microsoft Exchange Remote Code Execution Vulnerability
EPSS 37%
High 8.8
CVE-2020-17121 Microsoft SharePoint Remote Code Execution Vulnerability
EPSS 3%
High 8.8
CVE-2020-17143 Microsoft Exchange Server Information Disclosure Vulnerability
EPSS 71%
High 8.8
CVE-2020-17152 Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability
EPSS 3%
High 8.8
CVE-2020-17158 Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability
EPSS 3%
High 8.7
CVE-2020-17147 Dynamics CRM Webclient Cross-site Scripting Vulnerability
EPSS 1.4%
High 8.5
CVE-2020-17095 Windows Hyper-V Remote Code Execution Vulnerability
EPSS 5%
High 8.4
CVE-2020-17141 Microsoft Exchange Remote Code Execution Vulnerability
EPSS 6.6%
High 8.1
CVE-2020-17118 Microsoft SharePoint Remote Code Execution Vulnerability
EPSS 3.8%
High 8.1
CVE-2020-17140 Windows SMB Information Disclosure Vulnerability
EPSS 15%
High 8.0
CVE-2020-17115 Microsoft SharePoint Server Spoofing Vulnerability
EPSS 2.7%
High 7.8
CVE-2020-17136 Public exploit Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
EPSS 14%
High 7.8
CVE-2020-16958 Windows Backup Engine Elevation of Privilege Vulnerability
EPSS 1.1%
High 7.8
CVE-2020-16959 Windows Backup Engine Elevation of Privilege Vulnerability
EPSS 1.1%
High 7.8
CVE-2020-16960 Windows Backup Engine Elevation of Privilege Vulnerability
EPSS 1.3%
High 7.8
CVE-2020-16961 Windows Backup Engine Elevation of Privilege Vulnerability
EPSS 1.3%
High 7.8
CVE-2020-16962 Windows Backup Engine Elevation of Privilege Vulnerability
EPSS 1.1%
High 7.8
CVE-2020-16963 Windows Backup Engine Elevation of Privilege Vulnerability
EPSS 1.1%
High 7.8
CVE-2020-16964 Windows Backup Engine Elevation of Privilege Vulnerability
EPSS 1.1%
High 7.8
CVE-2020-17092 Windows Network Connections Service Elevation of Privilege Vulnerability
EPSS 1%
High 7.8
CVE-2020-17122 Microsoft Excel Remote Code Execution Vulnerability
EPSS 3.5%
High 7.8
CVE-2020-17123 Microsoft Excel Remote Code Execution Vulnerability
EPSS 3.6%
High 7.8
CVE-2020-17124 Microsoft PowerPoint Remote Code Execution Vulnerability
EPSS 3.5%
High 7.8
CVE-2020-17125 Microsoft Excel Remote Code Execution Vulnerability
EPSS 3.5%
High 7.8
CVE-2020-17127 Microsoft Excel Remote Code Execution Vulnerability
EPSS 3.5%
High 7.8
CVE-2020-17128 Microsoft Excel Remote Code Execution Vulnerability
EPSS 2.7%
High 7.8
CVE-2020-17129 Microsoft Excel Remote Code Execution Vulnerability
EPSS 3.5%
High 7.8
CVE-2020-17134 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
EPSS 1.2%
High 7.8
CVE-2020-17137 DirectX Graphics Kernel Elevation of Privilege Vulnerability
High 7.8
CVE-2020-17139 Windows Overlay Filter Security Feature Bypass Vulnerability
High 7.8
CVE-2020-17148 Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
EPSS 3.8%
High 7.8
CVE-2020-17150 Visual Studio Code Remote Code Execution Vulnerability
EPSS 3.2%
High 7.8
CVE-2020-17156 Visual Studio Remote Code Execution Vulnerability
EPSS 3.1%
High 7.8
CVE-2020-17159 Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability
EPSS 3.3%
High 7.5
CVE-2020-17096 Windows NTFS Remote Code Execution Vulnerability
EPSS 20%
High 7.4
CVE-2020-16971 Azure SDK for Java Security Feature Bypass Vulnerability
EPSS 4.3%
High 7.4
CVE-2020-17002 Azure SDK for C Security Feature Bypass Vulnerability
EPSS 3.5%
High 7.1
CVE-2020-17089 Microsoft SharePoint Elevation of Privilege Vulnerability
EPSS 2.9%
High 7.0
CVE-2020-17103 Public exploit Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
EPSS 30%

Medium15 Show

Medium 6.8
CVE-2020-17099 Windows Lock Screen Security Feature Bypass Vulnerability
EPSS 1%
Medium 6.6
CVE-2020-17117 Microsoft Exchange Remote Code Execution Vulnerability
EPSS 49%
Medium 6.5
CVE-2020-16996 Kerberos Security Feature Bypass Vulnerability
EPSS 2.4%
Medium 6.5
CVE-2020-17119 Microsoft Outlook Information Disclosure Vulnerability
EPSS 4%
Medium 6.5
CVE-2020-17130 Microsoft Excel Security Feature Bypass Vulnerability
EPSS 2.4%
Medium 6.5
CVE-2020-17133 Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability
EPSS 3.8%
Medium 6.4
CVE-2020-17135 Azure DevOps Server Spoofing Vulnerability
EPSS 1.3%
Medium 5.5
CVE-2020-17094 Windows Error Reporting Information Disclosure Vulnerability
EPSS 1.4%
Medium 5.5
CVE-2020-17098 Windows GDI+ Information Disclosure Vulnerability
EPSS 1.4%
Medium 5.5
CVE-2020-17126 Microsoft Excel Information Disclosure Vulnerability
EPSS 1.1%
Medium 5.5
CVE-2020-17138 Windows Error Reporting Information Disclosure Vulnerability
EPSS 1.1%
Medium 5.4
CVE-2020-17145 Azure DevOps Server and Team Foundation Services Spoofing Vulnerability
EPSS 1.6%
Medium 5.3
CVE-2020-17120 Microsoft SharePoint Information Disclosure Vulnerability
EPSS 3.1%
Medium 4.3
CVE-2020-17153 Microsoft Edge for Android Spoofing Vulnerability
EPSS 2.5%
Medium 4.2
CVE-2020-17131 Chakra Scripting Engine Memory Corruption Vulnerability
EPSS 2%

Low1 Show

Low 3.3
CVE-2020-17097 Windows Digital Media Receiver Elevation of Privilege Vulnerability
EPSS 1.1%