Microsoft Patch Tuesday — May 2021

Tuesday, 11 May 2021

Vulnerabilities: 52
Critical: 2
High: 35
Zero-days: 0
Public exploit: 5

Exploited 2

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

Critical 9.8
CVE-2021-31166 Exploited Public exploit HTTP Protocol Stack Remote Code Execution Vulnerability
EPSS 100%
Medium 6.6
CVE-2021-31207 Exploited Public exploit Microsoft Exchange Server Security Feature Bypass Vulnerability
EPSS 100%

Critical 1

Critical 9.9
CVE-2021-28476 Public exploit Windows Hyper-V Remote Code Execution Vulnerability
EPSS 39%

Public exploit code 2

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

High 8.8
CVE-2021-31181 Public exploit Microsoft SharePoint Remote Code Execution Vulnerability
EPSS 29%
Medium 5.5
CVE-2021-31184 Public exploit Microsoft Windows Infrared Data Association (IrDA) Information Disclosure Vulnerability
EPSS 1.6%

All vulnerabilities 52

Critical2 Show

Critical 9.8
CVE-2021-31166 Exploited Public exploit HTTP Protocol Stack Remote Code Execution Vulnerability
EPSS 100%
Critical 9.9
CVE-2021-28476 Public exploit Windows Hyper-V Remote Code Execution Vulnerability
EPSS 39%

High35 Show

High 8.8
CVE-2021-31181 Public exploit Microsoft SharePoint Remote Code Execution Vulnerability
EPSS 29%
High 8.8
CVE-2021-27068 Visual Studio Remote Code Execution Vulnerability
EPSS 54%
High 8.8
CVE-2021-28455 Microsoft Jet Red Database Engine and Access Connectivity Engine Remote Code Execution Vulnerability
EPSS 2.1%
High 8.8
CVE-2021-28474 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 51%
High 8.8
CVE-2021-31194 OLE Automation Remote Code Execution Vulnerability
EPSS 2.4%
High 7.8
CVE-2021-28465 Web Media Extensions Remote Code Execution Vulnerability
EPSS 3.7%
High 7.8
CVE-2021-31165 Windows Container Manager Service Elevation of Privilege Vulnerability
High 7.8
CVE-2021-31167 Windows Container Manager Service Elevation of Privilege Vulnerability
EPSS 1%
High 7.8
CVE-2021-31168 Windows Container Manager Service Elevation of Privilege Vulnerability
High 7.8
CVE-2021-31169 Windows Container Manager Service Elevation of Privilege Vulnerability
High 7.8
CVE-2021-31170 Windows Graphics Component Elevation of Privilege Vulnerability
EPSS 1%
High 7.8
CVE-2021-31175 Microsoft Office Remote Code Execution Vulnerability
EPSS 3.2%
High 7.8
CVE-2021-31176 Microsoft Office Remote Code Execution Vulnerability
EPSS 3%
High 7.8
CVE-2021-31177 Microsoft Office Remote Code Execution Vulnerability
EPSS 3.1%
High 7.8
CVE-2021-31179 Microsoft Office Remote Code Execution Vulnerability
EPSS 13%
High 7.8
CVE-2021-31180 Microsoft Office Graphics Remote Code Execution Vulnerability
EPSS 2.3%
High 7.8
CVE-2021-31187 Windows WalletService Elevation of Privilege Vulnerability
EPSS 1.1%
High 7.8
CVE-2021-31188 Windows Graphics Component Elevation of Privilege Vulnerability
EPSS 1.4%
High 7.8
CVE-2021-31190 Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability
High 7.8
CVE-2021-31192 Windows Media Foundation Core Remote Code Execution Vulnerability
EPSS 2.3%
High 7.8
CVE-2021-31193 Windows SSDP Service Elevation of Privilege Vulnerability
High 7.8
CVE-2021-31198 Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 4.9%
High 7.8
CVE-2021-31208 Windows Container Manager Service Elevation of Privilege Vulnerability
High 7.8
CVE-2021-31211 Visual Studio Code Remote Code Execution Vulnerability
EPSS 2.5%
High 7.8
CVE-2021-31213 Visual Studio Code Remote Containers Extension Remote Code Execution Vulnerability
EPSS 53%
High 7.8
CVE-2021-31214 Visual Studio Code Remote Code Execution Vulnerability
EPSS 2.9%
High 7.6
CVE-2021-28478 Microsoft SharePoint Server Spoofing Vulnerability
EPSS 1.6%
High 7.5
CVE-2021-26419 Scripting Engine Memory Corruption Vulnerability
EPSS 23%
High 7.4
CVE-2021-31186 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
EPSS 3%
High 7.4
CVE-2021-31936 Microsoft Accessibility Insights for Web Information Disclosure Vulnerability
EPSS 3.3%
High 7.3
CVE-2021-31204 .NET and Visual Studio Elevation of Privilege Vulnerability
EPSS 1.2%
High 7.2
CVE-2021-26422 Skype for Business and Lync Remote Code Execution Vulnerability
EPSS 2.2%
High 7.2
CVE-2021-31200 Common Utilities Remote Code Execution Vulnerability
EPSS 2.5%
High 7.1
CVE-2021-31172 Microsoft SharePoint Server Spoofing Vulnerability
EPSS 1.8%
High 7.1
CVE-2021-31182 Microsoft Bluetooth Driver Spoofing Vulnerability

Medium15 Show

Medium 6.6
CVE-2021-31207 Exploited Public exploit Microsoft Exchange Server Security Feature Bypass Vulnerability
EPSS 100%
Medium 6.5
CVE-2021-26421 Skype for Business and Lync Spoofing Vulnerability
EPSS 1.4%
Medium 6.5
CVE-2021-31195 Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 74%
Medium 6.5
CVE-2021-31205 Windows SMB Client Security Feature Bypass Vulnerability
EPSS 2.9%
Medium 6.5
CVE-2021-31209 Microsoft Exchange Server Spoofing Vulnerability
EPSS 2.6%
Medium 6.1
CVE-2021-28461 Dynamics Finance and Operations Cross-site Scripting Vulnerability
EPSS 1.3%
Medium 5.5
CVE-2021-31184 Public exploit Microsoft Windows Infrared Data Association (IrDA) Information Disclosure Vulnerability
EPSS 1.6%
Medium 5.5
CVE-2021-28479 Windows CSC Service Information Disclosure Vulnerability
Medium 5.5
CVE-2021-31174 Microsoft Excel Information Disclosure Vulnerability
EPSS 2.9%
Medium 5.5
CVE-2021-31178 Microsoft Office Information Disclosure Vulnerability
EPSS 16%
Medium 5.5
CVE-2021-31185 Windows Desktop Bridge Denial of Service Vulnerability
Medium 5.5
CVE-2021-31191 Windows Projected File System FS Filter Driver Information Disclosure Vulnerability
Medium 5.3
CVE-2021-31173 Microsoft SharePoint Server Information Disclosure Vulnerability
EPSS 2.1%
Medium 4.6
CVE-2021-26418 Microsoft SharePoint Server Spoofing Vulnerability
EPSS 1.2%
Medium 4.1
CVE-2021-31171 Microsoft SharePoint Information Disclosure Vulnerability

Most affected products

Windows 10 Version 2004 21 · 2 crit.
Windows 10 Version 20H2 20 · 1 crit.
Windows Server version 20H2 19 · 2 crit.
Windows Server version 2004 19 · 2 crit.
Windows 10 Version 1809 14 · 1 crit.
Windows Server 2019 13 · 1 crit.
Windows Server 2019 (Server Core installation) 13 · 1 crit.
Windows 10 Version 1909 13 · 1 crit.
Windows Server, version 1909 (Server Core installation) 12 · 1 crit.
Windows 10 Version 1803 12 · 1 crit.
Windows 10 Version 1607 10 · 1 crit.
Windows 10 Version 1507 10 · 1 crit.

About this page

CVEs published by Microsoft as CVE numbering authority from the day before to two days after its patch day (11 May). Exploitation status is updated daily, so a vulnerability can turn red after the release.

All Microsoft vulnerabilities →