Microsoft Patch Tuesday — December 2021

Tuesday, 14 December 2021

Vulnerabilities: 67
Critical: 7
High: 47
Zero-days: 1
Public exploit: 8

Exploited 2

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

High 7.8
CVE-2021-43226 Exploited Public exploit Windows Common Log File System Driver Elevation of Privilege Vulnerability
EPSS 3.3%
High 7.1
CVE-2021-43890 Zero-day Windows AppX Installer Spoofing Vulnerability
EPSS 11%

Critical 7

Critical 10.0
CVE-2021-42311 Microsoft Defender for IoT Remote Code Execution Vulnerability
EPSS 4.4%
Critical 10.0
CVE-2021-42313 Microsoft Defender for IoT Remote Code Execution Vulnerability
EPSS 4.1%
Critical 9.8
CVE-2021-43215 iSNS Server Memory Corruption Vulnerability Can Lead to Remote Code Execution
EPSS 2.9%
Critical 9.8
CVE-2021-43899 Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability
EPSS 2.6%
Critical 9.8
CVE-2021-43907 Visual Studio Code WSL Extension Remote Code Execution Vulnerability
EPSS 4%
Critical 9.6
CVE-2021-43905 Microsoft Office app Remote Code Execution Vulnerability
EPSS 3.1%
Critical 9.0
CVE-2021-43882 Microsoft Defender for IoT Remote Code Execution Vulnerability
EPSS 2.6%

Public exploit code 7

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

High 8.1
CVE-2021-43217 Public exploit Windows Encrypting File System (EFS) Remote Code Execution Vulnerability
EPSS 6.5%
High 7.8
CVE-2021-43229 Public exploit Windows NTFS Elevation of Privilege Vulnerability
EPSS 1.8%
High 7.8
CVE-2021-43883 Public exploit Windows Installer Elevation of Privilege Vulnerability
EPSS 12%
High 7.8
CVE-2021-43891 Public exploit Visual Studio Code Remote Code Execution Vulnerability
EPSS 12%
High 7.5
CVE-2021-43893 Public exploit Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability
EPSS 6.7%
Medium 5.5
CVE-2021-43224 Public exploit Windows Common Log File System Driver Information Disclosure Vulnerability
EPSS 3.9%
Medium 4.3
CVE-2021-43908 Public exploit Visual Studio Code Spoofing Vulnerability
EPSS 2.8%

All vulnerabilities 67

Critical7 Show

Critical 10.0
CVE-2021-42311 Microsoft Defender for IoT Remote Code Execution Vulnerability
EPSS 4.4%
Critical 10.0
CVE-2021-42313 Microsoft Defender for IoT Remote Code Execution Vulnerability
EPSS 4.1%
Critical 9.8
CVE-2021-43215 iSNS Server Memory Corruption Vulnerability Can Lead to Remote Code Execution
EPSS 2.9%
Critical 9.8
CVE-2021-43899 Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability
EPSS 2.6%
Critical 9.8
CVE-2021-43907 Visual Studio Code WSL Extension Remote Code Execution Vulnerability
EPSS 4%
Critical 9.6
CVE-2021-43905 Microsoft Office app Remote Code Execution Vulnerability
EPSS 3.1%
Critical 9.0
CVE-2021-43882 Microsoft Defender for IoT Remote Code Execution Vulnerability
EPSS 2.6%

High47 Show

High 7.8
CVE-2021-43226 Exploited Public exploit Windows Common Log File System Driver Elevation of Privilege Vulnerability
EPSS 3.3%
High 7.1
CVE-2021-43890 Zero-day Windows AppX Installer Spoofing Vulnerability
EPSS 11%
High 8.8
CVE-2021-41365 Microsoft Defender for IoT Remote Code Execution Vulnerability
EPSS 2.9%
High 8.8
CVE-2021-42309 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 2.9%
High 8.8
CVE-2021-42314 Microsoft Defender for IoT Remote Code Execution Vulnerability
EPSS 2.3%
High 8.8
CVE-2021-42315 Microsoft Defender for IoT Remote Code Execution Vulnerability
EPSS 2.3%
High 8.8
CVE-2021-43877 ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
High 8.1
CVE-2021-43217 Public exploit Windows Encrypting File System (EFS) Remote Code Execution Vulnerability
EPSS 6.5%
High 8.1
CVE-2021-42310 Microsoft Defender for IoT Remote Code Execution Vulnerability
EPSS 2.1%
High 8.0
CVE-2021-42320 Microsoft SharePoint Server Spoofing Vulnerability
EPSS 1.6%
High 7.8
CVE-2021-43229 Public exploit Windows NTFS Elevation of Privilege Vulnerability
EPSS 1.8%
High 7.8
CVE-2021-43883 Public exploit Windows Installer Elevation of Privilege Vulnerability
EPSS 12%
High 7.8
CVE-2021-43891 Public exploit Visual Studio Code Remote Code Execution Vulnerability
EPSS 12%
High 7.8
CVE-2021-40441 Windows Media Center Elevation of Privilege Vulnerability
High 7.8
CVE-2021-40452 HEVC Video Extensions Remote Code Execution Vulnerability
EPSS 2.7%
High 7.8
CVE-2021-40453 HEVC Video Extensions Remote Code Execution Vulnerability
EPSS 2.3%
High 7.8
CVE-2021-41333 Windows Print Spooler Elevation of Privilege Vulnerability
EPSS 1.1%
High 7.8
CVE-2021-41360 HEVC Video Extensions Remote Code Execution Vulnerability
EPSS 2.2%
High 7.8
CVE-2021-42312 Microsoft Defender for IoT Elevation of Privilege Vulnerability
High 7.8
CVE-2021-43207 Windows Common Log File System Driver Elevation of Privilege Vulnerability
High 7.8
CVE-2021-43214 Web Media Extensions Remote Code Execution Vulnerability
EPSS 1.8%
High 7.8
CVE-2021-43223 Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
High 7.8
CVE-2021-43230 Windows NTFS Elevation of Privilege Vulnerability
High 7.8
CVE-2021-43231 Windows NTFS Elevation of Privilege Vulnerability
High 7.8
CVE-2021-43232 Windows Event Tracing Remote Code Execution Vulnerability
EPSS 2.2%
High 7.8
CVE-2021-43234 Windows Fax Service Remote Code Execution Vulnerability
EPSS 2.2%
High 7.8
CVE-2021-43237 Windows Setup Elevation of Privilege Vulnerability
EPSS 1.1%
High 7.8
CVE-2021-43238 Windows Remote Access Elevation of Privilege Vulnerability
High 7.8
CVE-2021-43240 NTFS Set Short Name Elevation of Privilege Vulnerability
High 7.8
CVE-2021-43245 Windows Digital TV Tuner Elevation of Privilege Vulnerability
High 7.8
CVE-2021-43247 Windows TCP/IP Driver Elevation of Privilege Vulnerability
High 7.8
CVE-2021-43248 Windows Digital Media Receiver Elevation of Privilege Vulnerability
High 7.8
CVE-2021-43256 Microsoft Excel Remote Code Execution Vulnerability
EPSS 2.2%
High 7.8
CVE-2021-43875 Microsoft Office Graphics Remote Code Execution Vulnerability
EPSS 5.4%
High 7.6
CVE-2021-43242 Microsoft SharePoint Server Spoofing Vulnerability
EPSS 1.3%
High 7.5
CVE-2021-43893 Public exploit Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability
EPSS 6.7%
High 7.5
CVE-2021-43222 Microsoft Message Queuing Information Disclosure Vulnerability
EPSS 3.2%
High 7.5
CVE-2021-43225 Bot Framework SDK Remote Code Execution Vulnerability
EPSS 2.9%
High 7.5
CVE-2021-43228 SymCrypt Denial of Service Vulnerability
EPSS 3.9%
High 7.5
CVE-2021-43233 Remote Desktop Client Remote Code Execution Vulnerability
EPSS 2.4%
High 7.5
CVE-2021-43236 Microsoft Message Queuing Information Disclosure Vulnerability
EPSS 3.2%
High 7.5
CVE-2021-43888 Microsoft Defender for IoT Information Disclosure Vulnerability
EPSS 3.2%
High 7.4
CVE-2021-43219 DirectX Graphics Kernel File Denial of Service Vulnerability
EPSS 3.9%
High 7.4
CVE-2021-43892 Microsoft BizTalk ESB Toolkit Spoofing Vulnerability
EPSS 3%
High 7.2
CVE-2021-42294 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 2.3%
High 7.2
CVE-2021-43889 Microsoft Defender for IoT Remote Code Execution Vulnerability
EPSS 2.4%
High 7.1
CVE-2021-43239 Windows Recovery Environment Agent Elevation of Privilege Vulnerability

Medium13 Show

Medium 6.5
CVE-2021-42293 Microsoft Jet Red Database Engine and Access Connectivity Engine Elevation of Privilege Vulnerability
EPSS 3%
Medium 6.5
CVE-2021-43216 Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
EPSS 3.4%
Medium 6.5
CVE-2021-43244 Windows Kernel Information Disclosure Vulnerability
Medium 5.6
CVE-2021-43246 Windows Hyper-V Denial of Service Vulnerability
Medium 5.5
CVE-2021-43224 Public exploit Windows Common Log File System Driver Information Disclosure Vulnerability
EPSS 3.9%
Medium 5.5
CVE-2021-42295 Visual Basic for Applications Information Disclosure Vulnerability
EPSS 3%
Medium 5.5
CVE-2021-43227 Storage Spaces Controller Information Disclosure Vulnerability
Medium 5.5
CVE-2021-43235 Storage Spaces Controller Information Disclosure Vulnerability
Medium 5.5
CVE-2021-43243 VP9 Video Extensions Information Disclosure Vulnerability
Medium 5.5
CVE-2021-43255 Microsoft Office Trust Center Spoofing Vulnerability
EPSS 2.1%
Medium 5.5
CVE-2021-43880 Windows Mobile Device Management Elevation of Privilege Vulnerability
Medium 5.5
CVE-2021-43896 Microsoft PowerShell Spoofing Vulnerability
EPSS 2.5%
Medium 4.3
CVE-2021-43908 Public exploit Visual Studio Code Spoofing Vulnerability
EPSS 2.8%