Patch days / April 2021

Microsoft Patch Tuesday — April 2021

Tuesday, 13 April 2021

Vulnerabilities: 108
Critical: 3
High: 77
Zero-days: 0
Public exploit: 5

Exploited 1

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

High 7.8
CVE-2021-28310 Exploited Public exploit Win32k Elevation of Privilege Vulnerability
EPSS 8.4%

Critical 3

Critical 9.8
CVE-2021-28480 Public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 71%
Critical 9.8
CVE-2021-28481 Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 36%
Critical 9.0
CVE-2021-28483 Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 1.2%

Public exploit code 3

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

High 8.8
CVE-2021-28482 Public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 83%
High 7.8
CVE-2021-26415 Public exploit Windows Installer Elevation of Privilege Vulnerability
EPSS 3.6%
Low 3.3
CVE-2021-28312 Public exploit Windows NTFS Denial of Service Vulnerability
EPSS 6.6%

All vulnerabilities 108

Critical3 Show

Critical 9.8
CVE-2021-28480 Public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 71%
Critical 9.8
CVE-2021-28481 Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 36%
Critical 9.0
CVE-2021-28483 Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 1.2%

High77 Show

High 7.8
CVE-2021-28310 Exploited Public exploit Win32k Elevation of Privilege Vulnerability
EPSS 8.4%
High 8.8
CVE-2021-28482 Public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 83%
High 8.8
CVE-2021-28327 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28329 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28330 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28331 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28332 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28333 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28334 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28335 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28336 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28337 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28338 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28339 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28340 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28341 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28342 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28343 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28344 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28345 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28346 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28352 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28353 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28354 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28355 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28356 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28357 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28358 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2021-28434 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.5%
High 8.1
CVE-2021-28445 Windows Network File System Remote Code Execution Vulnerability
EPSS 2.9%
High 8.1
CVE-2021-28460 Azure Sphere Unsigned Code Execution Vulnerability
High 7.8
CVE-2021-26415 Public exploit Windows Installer Elevation of Privilege Vulnerability
EPSS 3.6%
High 7.8
CVE-2021-27064 Visual Studio Installer Elevation of Privilege Vulnerability
High 7.8
CVE-2021-27086 Windows Services and Controller App Elevation of Privilege Vulnerability
High 7.8
CVE-2021-27088 Windows Event Tracing Elevation of Privilege Vulnerability
High 7.8
CVE-2021-27089 Microsoft Internet Messaging API Remote Code Execution Vulnerability
EPSS 2.4%
High 7.8
CVE-2021-27090 Windows Secure Kernel Mode Elevation of Privilege Vulnerability
High 7.8
CVE-2021-27091 RPC Endpoint Mapper Service Elevation of Privilege Vulnerability
High 7.8
CVE-2021-27095 Windows Media Video Decoder Remote Code Execution Vulnerability
EPSS 4.3%
High 7.8
CVE-2021-27096 NTFS Elevation of Privilege Vulnerability
High 7.8
CVE-2021-28313 Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability
EPSS 1%
High 7.8
CVE-2021-28314 Windows Hyper-V Elevation of Privilege Vulnerability
High 7.8
CVE-2021-28315 Windows Media Video Decoder Remote Code Execution Vulnerability
EPSS 1.6%
High 7.8
CVE-2021-28320 Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability
High 7.8
CVE-2021-28321 Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability
EPSS 1.3%
High 7.8
CVE-2021-28322 Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability
EPSS 1%
High 7.8
CVE-2021-28347 Windows Speech Runtime Elevation of Privilege Vulnerability
High 7.8
CVE-2021-28348 Windows GDI+ Remote Code Execution Vulnerability
High 7.8
CVE-2021-28349 Windows GDI+ Remote Code Execution Vulnerability
High 7.8
CVE-2021-28350 Windows GDI+ Remote Code Execution Vulnerability
High 7.8
CVE-2021-28351 Windows Speech Runtime Elevation of Privilege Vulnerability
High 7.8
CVE-2021-28436 Windows Speech Runtime Elevation of Privilege Vulnerability
High 7.8
CVE-2021-28448 Visual Studio Code Kubernetes Tools Remote Code Execution Vulnerability
EPSS 2.4%
High 7.8
CVE-2021-28449 Microsoft Office Remote Code Execution Vulnerability
EPSS 2.7%
High 7.8
CVE-2021-28451 Microsoft Excel Remote Code Execution Vulnerability
EPSS 2.5%
High 7.8
CVE-2021-28453 Microsoft Word Remote Code Execution Vulnerability
EPSS 4.1%
High 7.8
CVE-2021-28454 Microsoft Excel Remote Code Execution Vulnerability
EPSS 3.4%
High 7.8
CVE-2021-28457 Visual Studio Code Remote Code Execution Vulnerability
EPSS 2.7%
High 7.8
CVE-2021-28458 Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerability
EPSS 2%
High 7.8
CVE-2021-28464 VP9 Video Extensions Remote Code Execution Vulnerability
EPSS 2.4%
High 7.8
CVE-2021-28466 Raw Image Extension Remote Code Execution Vulnerability
EPSS 2.4%
High 7.8
CVE-2021-28468 Raw Image Extension Remote Code Execution Vulnerability
EPSS 6.3%
High 7.8
CVE-2021-28469 Visual Studio Code Remote Code Execution Vulnerability
EPSS 2.7%
High 7.8
CVE-2021-28470 Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability
EPSS 2.4%
High 7.8
CVE-2021-28471 Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability
EPSS 4.1%
High 7.8
CVE-2021-28472 Visual Studio Code Maven for Java Extension Remote Code Execution Vulnerability
EPSS 62%
High 7.8
CVE-2021-28473 Visual Studio Code Remote Code Execution Vulnerability
EPSS 2.7%
High 7.8
CVE-2021-28475 Visual Studio Code Remote Code Execution Vulnerability
EPSS 2.7%
High 7.7
CVE-2021-26416 Windows Hyper-V Denial of Service Vulnerability
EPSS 4.2%
High 7.5
CVE-2021-28319 Windows TCP/IP Driver Denial of Service Vulnerability
EPSS 10%
High 7.5
CVE-2021-28324 Windows SMB Information Disclosure Vulnerability
EPSS 6.6%
High 7.5
CVE-2021-28439 Windows TCP/IP Driver Denial of Service Vulnerability
EPSS 6.5%
High 7.1
CVE-2021-28446 Windows Portmapping Information Disclosure Vulnerability
High 7.1
CVE-2021-28452 Microsoft Outlook Memory Corruption Vulnerability
EPSS 1.4%
High 7.0
CVE-2021-27072 Win32k Elevation of Privilege Vulnerability
High 7.0
CVE-2021-28440 Windows Installer Elevation of Privilege Vulnerability
High 7.0
CVE-2021-28477 Visual Studio Code Remote Code Execution Vulnerability
EPSS 2.3%

Medium27 Show

Medium 6.8
CVE-2021-27092 Azure AD Web Sign-in Security Feature Bypass Vulnerability
EPSS 2.8%
Medium 6.5
CVE-2021-27067 Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability
EPSS 2.8%
Medium 6.5
CVE-2021-28311 Windows Application Compatibility Cache Denial of Service Vulnerability
EPSS 2.7%
Medium 6.5
CVE-2021-28323 Windows DNS Information Disclosure Vulnerability
EPSS 4.6%
Medium 6.5
CVE-2021-28325 Windows SMB Information Disclosure Vulnerability
EPSS 64%
Medium 6.5
CVE-2021-28328 Windows DNS Information Disclosure Vulnerability
EPSS 2.7%
Medium 6.5
CVE-2021-28441 Windows Hyper-V Information Disclosure Vulnerability
Medium 6.5
CVE-2021-28442 Windows TCP/IP Information Disclosure Vulnerability
EPSS 6.9%
Medium 6.2
CVE-2021-26413 Windows Installer Spoofing Vulnerability
Medium 6.1
CVE-2021-28459 Azure DevOps Server Spoofing Vulnerability
EPSS 2.3%
Medium 5.7
CVE-2021-27079 Windows Media Photo Codec Information Disclosure Vulnerability
EPSS 3.1%
Medium 5.7
CVE-2021-28444 Windows Hyper-V Security Feature Bypass Vulnerability
EPSS 1.9%
Medium 5.5
CVE-2021-26417 Windows Overlay Filter Information Disclosure Vulnerability
Medium 5.5
CVE-2021-27093 Windows Kernel Information Disclosure Vulnerability
Medium 5.5
CVE-2021-28309 Windows Kernel Information Disclosure Vulnerability
Medium 5.5
CVE-2021-28317 Microsoft Windows Codecs Library Information Disclosure Vulnerability
Medium 5.5
CVE-2021-28318 Windows GDI+ Information Disclosure Vulnerability
Medium 5.5
CVE-2021-28326 Windows AppX Deployment Server Denial of Service Vulnerability
EPSS 1%
Medium 5.5
CVE-2021-28435 Windows Event Tracing Information Disclosure Vulnerability
Medium 5.5
CVE-2021-28437 Windows Installer Information Disclosure Vulnerability
Medium 5.5
CVE-2021-28438 Windows Console Driver Denial of Service Vulnerability
Medium 5.5
CVE-2021-28443 Windows Console Driver Denial of Service Vulnerability
Medium 5.5
CVE-2021-28456 Microsoft Excel Information Disclosure Vulnerability
EPSS 3.7%
Medium 5.0
CVE-2021-28450 Microsoft SharePoint Denial of Service Vulnerability
EPSS 2.6%
Medium 4.4
CVE-2021-27094 Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability
EPSS 1%
Medium 4.4
CVE-2021-28447 Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability
EPSS 2.2%
Medium 4.2
CVE-2021-28316 Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability
EPSS 1.2%

Low1 Show

Low 3.3
CVE-2021-28312 Public exploit Windows NTFS Denial of Service Vulnerability
EPSS 6.6%