Patch days / May 2022

Microsoft Patch Tuesday — May 2022

Tuesday, 10 May 2022

Vulnerabilities: 73
Critical: 3
High: 47
Zero-days: 0
Public exploit: 6

Exploited 2

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

High 8.8
CVE-2022-26923 Exploited Public exploit Active Directory Domain Services Elevation of Privilege Vulnerability
EPSS 84%
High 8.1
CVE-2022-26925 Exploited Windows LSA Spoofing Vulnerability
EPSS 10%

Critical 3

Critical 9.8
CVE-2022-26937 Public exploit Windows Network File System Remote Code Execution Vulnerability
EPSS 76%
Critical 9.8
CVE-2022-22012 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
EPSS 4.2%
Critical 9.8
CVE-2022-29130 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
EPSS 3.9%

Public exploit code 4

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

High 8.8
CVE-2022-26927 Public exploit Windows Graphics Component Remote Code Execution Vulnerability
EPSS 4.6%
High 8.8
CVE-2022-30129 Public exploit Visual Studio Code Remote Code Execution Vulnerability
EPSS 42%
High 8.1
CVE-2022-23270 Public exploit Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
EPSS 70%
High 7.5
CVE-2022-29117 Public exploit .NET and Visual Studio Denial of Service Vulnerability
EPSS 5.7%

All vulnerabilities 73

Critical3 Show

Critical 9.8
CVE-2022-26937 Public exploit Windows Network File System Remote Code Execution Vulnerability
EPSS 76%
Critical 9.8
CVE-2022-22012 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
EPSS 4.2%
Critical 9.8
CVE-2022-29130 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
EPSS 3.9%

High47 Show

High 8.8
CVE-2022-26923 Exploited Public exploit Active Directory Domain Services Elevation of Privilege Vulnerability
EPSS 84%
High 8.1
CVE-2022-26925 Exploited Windows LSA Spoofing Vulnerability
EPSS 10%
High 8.8
CVE-2022-26927 Public exploit Windows Graphics Component Remote Code Execution Vulnerability
EPSS 4.6%
High 8.8
CVE-2022-30129 Public exploit Visual Studio Code Remote Code Execution Vulnerability
EPSS 42%
High 8.8
CVE-2022-22013 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2022-22014 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2022-22017 Remote Desktop Client Remote Code Execution Vulnerability
EPSS 37%
High 8.8
CVE-2022-22019 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 2.7%
High 8.8
CVE-2022-29108 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 11%
High 8.8
CVE-2022-29128 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
EPSS 2.9%
High 8.8
CVE-2022-29129 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
EPSS 2.9%
High 8.8
CVE-2022-29131 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
EPSS 2.9%
High 8.8
CVE-2022-29133 Windows Kernel Elevation of Privilege Vulnerability
High 8.8
CVE-2022-29137 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
EPSS 2.5%
High 8.8
CVE-2022-29139 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
EPSS 2.4%
High 8.8
CVE-2022-29141 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
EPSS 2.8%
High 8.2
CVE-2022-21978 Microsoft Exchange Server Elevation of Privilege Vulnerability
High 8.2
CVE-2022-26932 Storage Spaces Direct Elevation of Privilege Vulnerability
High 8.1
CVE-2022-23270 Public exploit Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
EPSS 70%
High 8.1
CVE-2022-21972 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
EPSS 79%
High 7.8
CVE-2022-26926 Windows Address Book Remote Code Execution Vulnerability
EPSS 2.8%
High 7.8
CVE-2022-29103 Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
High 7.8
CVE-2022-29104 Windows Print Spooler Elevation of Privilege Vulnerability
EPSS 12%
High 7.8
CVE-2022-29105 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
EPSS 2.8%
High 7.8
CVE-2022-29109 Microsoft Excel Remote Code Execution Vulnerability
EPSS 2.8%
High 7.8
CVE-2022-29110 Microsoft Excel Remote Code Execution Vulnerability
EPSS 3.8%
High 7.8
CVE-2022-29113 Windows Digital Media Receiver Elevation of Privilege Vulnerability
High 7.8
CVE-2022-29115 Windows Fax Service Remote Code Execution Vulnerability
EPSS 2.4%
High 7.8
CVE-2022-29132 Windows Print Spooler Elevation of Privilege Vulnerability
High 7.8
CVE-2022-29148 Visual Studio Remote Code Execution Vulnerability
EPSS 2.8%
High 7.5
CVE-2022-29117 Public exploit .NET and Visual Studio Denial of Service Vulnerability
EPSS 5.7%
High 7.5
CVE-2022-23267 .NET and Visual Studio Denial of Service Vulnerability
EPSS 5.7%
High 7.5
CVE-2022-26931 Windows Kerberos Elevation of Privilege Vulnerability
EPSS 2.7%
High 7.5
CVE-2022-29145 .NET and Visual Studio Denial of Service Vulnerability
EPSS 5.5%
High 7.4
CVE-2022-26913 Windows Authentication Information Disclosure Vulnerability
EPSS 2.5%
High 7.0
CVE-2022-22016 Windows PlayToManager Elevation of Privilege Vulnerability
High 7.0
CVE-2022-23279 Windows ALPC Elevation of Privilege Vulnerability
EPSS 4.7%
High 7.0
CVE-2022-26938 Storage Spaces Direct Elevation of Privilege Vulnerability
High 7.0
CVE-2022-26939 Storage Spaces Direct Elevation of Privilege Vulnerability
High 7.0
CVE-2022-29106 Windows Hyper-V Shared Virtual Disk Elevation of Privilege Vulnerability
High 7.0
CVE-2022-29125 Windows Push Notifications Apps Elevation of Privilege Vulnerability
High 7.0
CVE-2022-29126 Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability
High 7.0
CVE-2022-29135 Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability
High 7.0
CVE-2022-29138 Windows Clustered Shared Volume Elevation of Privilege Vulnerability
High 7.0
CVE-2022-29142 Windows Kernel Elevation of Privilege Vulnerability
EPSS 5.1%
High 7.0
CVE-2022-29150 Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability
High 7.0
CVE-2022-29151 Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability

Medium22 Show

Medium 6.5
CVE-2022-22015 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
EPSS 2.7%
Medium 6.5
CVE-2022-26934 Windows Graphics Component Information Disclosure Vulnerability
EPSS 3.1%
Medium 6.5
CVE-2022-26935 Windows WLAN AutoConfig Service Information Disclosure Vulnerability
EPSS 1.1%
Medium 6.5
CVE-2022-26936 Windows Server Service Information Disclosure Vulnerability
EPSS 3.1%
Medium 6.5
CVE-2022-26940 Remote Desktop Protocol Client Information Disclosure Vulnerability
EPSS 2.7%
Medium 6.5
CVE-2022-29112 Windows Graphics Component Information Disclosure Vulnerability
EPSS 3.5%
Medium 6.5
CVE-2022-29120 Windows Clustered Shared Volume Information Disclosure Vulnerability
Medium 6.5
CVE-2022-29121 Windows WLAN AutoConfig Service Denial of Service Vulnerability
Medium 6.5
CVE-2022-29122 Windows Clustered Shared Volume Information Disclosure Vulnerability
Medium 6.5
CVE-2022-29123 Windows Clustered Shared Volume Information Disclosure Vulnerability
Medium 6.5
CVE-2022-29134 Windows Clustered Shared Volume Information Disclosure Vulnerability
Medium 5.6
CVE-2022-22713 Windows Hyper-V Denial of Service Vulnerability
Medium 5.5
CVE-2022-22011 Windows Graphics Component Information Disclosure Vulnerability
Medium 5.5
CVE-2022-26930 Windows Remote Access Connection Manager Information Disclosure Vulnerability
Medium 5.5
CVE-2022-26933 Windows NTFS Information Disclosure Vulnerability
Medium 5.5
CVE-2022-29102 Windows Failover Cluster Information Disclosure Vulnerability
Medium 5.5
CVE-2022-29107 Microsoft Office Security Feature Bypass Vulnerability
EPSS 3.1%
Medium 5.5
CVE-2022-29114 Windows Print Spooler Information Disclosure Vulnerability
EPSS 1.3%
Medium 5.5
CVE-2022-29140 Windows Print Spooler Information Disclosure Vulnerability
EPSS 1.2%
Medium 4.7
CVE-2022-29116 Windows Kernel Information Disclosure Vulnerability
Medium 4.2
CVE-2022-29127 BitLocker Security Feature Bypass Vulnerability
Medium 4.1
CVE-2022-24466 Windows Hyper-V Security Feature Bypass Vulnerability

Low1 Show

Low 3.3
CVE-2022-30130 .NET Framework Denial of Service Vulnerability
EPSS 3.2%

Most affected products

Windows Server version 20H2 58 · 3 crit.
Windows Server 2019 56 · 3 crit.
Windows Server 2022 56 · 3 crit.
Windows Server 2019 (Server Core installation) 55 · 3 crit.
Windows Server 2016 51 · 3 crit.
Windows Server 2016 (Server Core installation) 51 · 3 crit.
Windows Server 2012 R2 44 · 3 crit.
Windows Server 2012 R2 (Server Core installation) 44 · 3 crit.
Windows 10 Version 21H2 44 · 2 crit.
Windows 11 version 21H2 44 · 2 crit.
Windows 10 Version 21H1 44 · 2 crit.
Windows 10 Version 1909 43 · 2 crit.

About this page

CVEs published by Microsoft as CVE numbering authority from the day before to two days after its patch day (10 May). Exploitation status is updated daily, so a vulnerability can turn red after the release.

All Microsoft vulnerabilities →