Microsoft Patch Tuesday — September 2022

Tuesday, 13 September 2022

Vulnerabilities: 63
Critical: 3
High: 53
Zero-days: 1
Public exploit: 4

Exploited 1

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

High 7.8
CVE-2022-37969 Zero-day Public exploit Windows Common Log File System Driver Elevation of Privilege Vulnerability
EPSS 28%

Critical 3

Critical 9.8
CVE-2022-34718 Public exploit Windows TCP/IP Remote Code Execution Vulnerability
EPSS 57%
Critical 9.8
CVE-2022-34721 Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
EPSS 77%
Critical 9.8
CVE-2022-34722 Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
EPSS 3%

Public exploit code 2

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

High 8.8
CVE-2022-35841 Public exploit Windows Enterprise App Management Service Remote Code Execution Vulnerability
EPSS 3.7%
High 8.1
CVE-2022-33679 Public exploit Windows Kerberos Elevation of Privilege Vulnerability
EPSS 12%

All vulnerabilities 63

Critical3 Show

Critical 9.8
CVE-2022-34718 Public exploit Windows TCP/IP Remote Code Execution Vulnerability
EPSS 57%
Critical 9.8
CVE-2022-34721 Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
EPSS 77%
Critical 9.8
CVE-2022-34722 Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
EPSS 3%

High53 Show

High 7.8
CVE-2022-37969 Zero-day Public exploit Windows Common Log File System Driver Elevation of Privilege Vulnerability
EPSS 28%
High 8.8
CVE-2022-35841 Public exploit Windows Enterprise App Management Service Remote Code Execution Vulnerability
EPSS 3.7%
High 8.8
CVE-2022-34700 Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability
EPSS 3.8%
High 8.8
CVE-2022-34726 Microsoft ODBC Driver Remote Code Execution Vulnerability
EPSS 2.8%
High 8.8
CVE-2022-34727 Microsoft ODBC Driver Remote Code Execution Vulnerability
EPSS 2.8%
High 8.8
CVE-2022-34730 Microsoft ODBC Driver Remote Code Execution Vulnerability
EPSS 2.8%
High 8.8
CVE-2022-34731 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 2.2%
High 8.8
CVE-2022-34732 Microsoft ODBC Driver Remote Code Execution Vulnerability
EPSS 2.8%
High 8.8
CVE-2022-34733 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 2.2%
High 8.8
CVE-2022-34734 Microsoft ODBC Driver Remote Code Execution Vulnerability
EPSS 2.8%
High 8.8
CVE-2022-35805 Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability
EPSS 3.3%
High 8.8
CVE-2022-35823 Microsoft SharePoint Remote Code Execution Vulnerability
EPSS 55%
High 8.8
CVE-2022-35834 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 2.2%
High 8.8
CVE-2022-35835 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 2.2%
High 8.8
CVE-2022-35836 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 2.2%
High 8.8
CVE-2022-35840 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 2.2%
High 8.8
CVE-2022-37961 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 52%
High 8.8
CVE-2022-38008 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 2.1%
High 8.8
CVE-2022-38009 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 2.2%
High 8.2
CVE-2022-30196 Windows Secure Channel Denial of Service Vulnerability
EPSS 2.1%
High 8.1
CVE-2022-33679 Public exploit Windows Kerberos Elevation of Privilege Vulnerability
EPSS 12%
High 8.1
CVE-2022-33647 Windows Kerberos Elevation of Privilege Vulnerability
EPSS 2.3%
High 8.1
CVE-2022-35830 Remote Procedure Call Runtime Remote Code Execution Vulnerability
EPSS 1.8%
High 8.1
CVE-2022-37958 SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
EPSS 86%
High 7.8
CVE-2022-26929 .NET Framework Remote Code Execution Vulnerability
EPSS 1.6%
High 7.8
CVE-2022-30200 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
EPSS 1.3%
High 7.8
CVE-2022-34719 Windows Distributed File System (DFS) Elevation of Privilege Vulnerability
EPSS 1.1%
High 7.8
CVE-2022-34729 Windows GDI Elevation of Privilege Vulnerability
EPSS 11%
High 7.8
CVE-2022-35803 Windows Common Log File System Driver Elevation of Privilege Vulnerability
EPSS 24%
High 7.8
CVE-2022-35828 Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability
High 7.8
CVE-2022-37954 DirectX Graphics Kernel Elevation of Privilege Vulnerability
EPSS 46%
High 7.8
CVE-2022-37955 Windows Group Policy Elevation of Privilege Vulnerability
EPSS 2.2%
High 7.8
CVE-2022-37956 Windows Kernel Elevation of Privilege Vulnerability
EPSS 1.4%
High 7.8
CVE-2022-37957 Windows Kernel Elevation of Privilege Vulnerability
EPSS 14%
High 7.8
CVE-2022-37962 Microsoft PowerPoint Remote Code Execution Vulnerability
EPSS 1.4%
High 7.8
CVE-2022-37963 Microsoft Office Visio Remote Code Execution Vulnerability
EPSS 1.1%
High 7.8
CVE-2022-37964 Windows Kernel Elevation of Privilege Vulnerability
EPSS 1.1%
High 7.8
CVE-2022-38004 Windows Fax Service Remote Code Execution Vulnerability
EPSS 1.1%
High 7.8
CVE-2022-38005 Windows Print Spooler Elevation of Privilege Vulnerability
High 7.8
CVE-2022-38007 Azure Guest Configuration and Azure Arc-enabled servers Elevation of Privilege Vulnerability
High 7.8
CVE-2022-38010 Microsoft Office Visio Remote Code Execution Vulnerability
High 7.8
CVE-2022-38019 AV1 Video Extension Remote Code Execution Vulnerability
High 7.7
CVE-2022-38012 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
High 7.5
CVE-2022-34720 Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
EPSS 3.7%
High 7.5
CVE-2022-34724 Windows DNS Server Denial of Service Vulnerability
EPSS 3.8%
High 7.5
CVE-2022-35833 Windows Secure Channel Denial of Service Vulnerability
EPSS 3.1%
High 7.5
CVE-2022-35838 HTTP V3 Denial of Service Vulnerability
EPSS 2.7%
High 7.5
CVE-2022-38013 .NET Core and Visual Studio Denial of Service Vulnerability
EPSS 4.3%
High 7.3
CVE-2022-30170 Windows Credential Roaming Service Elevation of Privilege Vulnerability
EPSS 1.7%
High 7.3
CVE-2022-38011 Raw Image Extension Remote Code Execution Vulnerability
High 7.3
CVE-2022-38020 Visual Studio Code Elevation of Privilege Vulnerability
EPSS 1.1%
High 7.0
CVE-2022-26928 Windows Photo Import API Elevation of Privilege Vulnerability
High 7.0
CVE-2022-34725 Windows ALPC Elevation of Privilege Vulnerability
EPSS 5.5%

Medium7 Show

Medium 6.5
CVE-2022-35837 Windows Graphics Component Information Disclosure Vulnerability
EPSS 2.6%
Medium 6.5
CVE-2022-37959 Network Device Enrollment Service (NDES) Security Feature Bypass Vulnerability
EPSS 2.4%
Medium 6.5
CVE-2022-38006 Windows Graphics Component Information Disclosure Vulnerability
EPSS 2.3%
Medium 5.5
CVE-2022-34723 Windows DPAPI (Data Protection Application Programming Interface) Information Disclosure Vulnerability
EPSS 1.1%
Medium 5.5
CVE-2022-34728 Windows Graphics Component Information Disclosure Vulnerability
EPSS 4.3%
Medium 5.5
CVE-2022-35831 Windows Remote Access Connection Manager Information Disclosure Vulnerability
Medium 5.5
CVE-2022-35832 Windows Event Tracing Denial of Service Vulnerability

Most affected products

Windows Server 2022 44 · 3 crit.
Windows Server 2019 43 · 3 crit.
Windows Server 2019 (Server Core installation) 43 · 3 crit.
Windows Server 2016 41 · 3 crit.
Windows Server 2016 (Server Core installation) 41 · 3 crit.
Windows 11 version 21H2 40 · 3 crit.
Windows 10 Version 1809 38 · 3 crit.
Windows 10 Version 21H2 38 · 3 crit.
Windows Server 2012 R2 38 · 3 crit.
Windows Server 2012 R2 (Server Core installation) 38 · 3 crit.
Windows 10 Version 20H2 38 · 3 crit.
Windows 10 Version 21H1 38 · 3 crit.

About this page

CVEs published by Microsoft as CVE numbering authority from the day before to two days after its patch day (13 Sep). Exploitation status is updated daily, so a vulnerability can turn red after the release.

All Microsoft vulnerabilities →