Patch days / October 2022

Microsoft Patch Tuesday — October 2022

Tuesday, 11 October 2022

Vulnerabilities: 85
Critical: 1
High: 65
Zero-days: 1
Public exploit: 3

Exploited 2

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

High 7.8
CVE-2022-38028 Exploited Windows Print Spooler Elevation of Privilege Vulnerability
EPSS 15%
High 7.8
CVE-2022-41033 Zero-day Windows COM+ Event System Service Elevation of Privilege Vulnerability
EPSS 1.9%

Critical 1

Critical 10.0
CVE-2022-37968 Azure Arc-enabled Kubernetes cluster Connect Elevation of Privilege Vulnerability
EPSS 3%

Public exploit code 3

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

High 7.8
CVE-2022-41034 Public exploit Visual Studio Code Remote Code Execution Vulnerability
EPSS 67%
High 7.8
CVE-2022-41032 Public exploit NuGet Client Elevation of Privilege Vulnerability
EPSS 1.3%
High 7.0
CVE-2022-38029 Public exploit Windows ALPC Elevation of Privilege Vulnerability

All vulnerabilities 85

Critical1 Show

Critical 10.0
CVE-2022-37968 Azure Arc-enabled Kubernetes cluster Connect Elevation of Privilege Vulnerability
EPSS 3%

High65 Show

High 7.8
CVE-2022-38028 Exploited Windows Print Spooler Elevation of Privilege Vulnerability
EPSS 15%
High 7.8
CVE-2022-41033 Zero-day Windows COM+ Event System Service Elevation of Privilege Vulnerability
EPSS 1.9%
High 8.8
CVE-2022-37975 Windows Group Policy Elevation of Privilege Vulnerability
EPSS 1.9%
High 8.8
CVE-2022-37976 Active Directory Certificate Services Elevation of Privilege Vulnerability
EPSS 2.4%
High 8.8
CVE-2022-37982 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 2%
High 8.8
CVE-2022-38016 Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
High 8.8
CVE-2022-38031 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 2%
High 8.8
CVE-2022-38034 Windows Workstation Service Elevation of Privilege Vulnerability
EPSS 4%
High 8.8
CVE-2022-38040 Microsoft ODBC Driver Remote Code Execution Vulnerability
EPSS 2%
High 8.8
CVE-2022-38045 Windows Server Service Elevation of Privilege Vulnerability
EPSS 2.8%
High 8.8
CVE-2022-38053 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 76%
High 8.8
CVE-2022-41036 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 2.1%
High 8.8
CVE-2022-41037 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 2.1%
High 8.8
CVE-2022-41038 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 3.4%
High 8.1
CVE-2022-22035 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.6%
High 8.1
CVE-2022-24504 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.5%
High 8.1
CVE-2022-30198 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.5%
High 8.1
CVE-2022-33634 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.5%
High 8.1
CVE-2022-38000 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.6%
High 8.1
CVE-2022-38047 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.5%
High 8.1
CVE-2022-41081 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.9%
High 7.8
CVE-2022-41034 Public exploit Visual Studio Code Remote Code Execution Vulnerability
EPSS 67%
High 7.8
CVE-2022-41032 Public exploit NuGet Client Elevation of Privilege Vulnerability
EPSS 1.3%
High 7.8
CVE-2022-33635 Windows GDI+ Remote Code Execution Vulnerability
EPSS 1.1%
High 7.8
CVE-2022-37970 Windows DWM Core Library Elevation of Privilege Vulnerability
EPSS 9.8%
High 7.8
CVE-2022-37979 Windows Hyper-V Elevation of Privilege Vulnerability
High 7.8
CVE-2022-37980 Windows DHCP Client Elevation of Privilege Vulnerability
High 7.8
CVE-2022-37983 Microsoft DWM Core Library Elevation of Privilege Vulnerability
High 7.8
CVE-2022-37984 Windows WLAN Service Elevation of Privilege Vulnerability
High 7.8
CVE-2022-37986 Windows Win32k Elevation of Privilege Vulnerability
High 7.8
CVE-2022-37987 Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
EPSS 9.1%
High 7.8
CVE-2022-37988 Windows Kernel Elevation of Privilege Vulnerability
EPSS 1.1%
High 7.8
CVE-2022-37989 Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
EPSS 9.3%
High 7.8
CVE-2022-37990 Windows Kernel Elevation of Privilege Vulnerability
High 7.8
CVE-2022-37991 Windows Kernel Elevation of Privilege Vulnerability
EPSS 1.1%
High 7.8
CVE-2022-37993 Windows Group Policy Preference Client Elevation of Privilege Vulnerability
High 7.8
CVE-2022-37994 Windows Group Policy Preference Client Elevation of Privilege Vulnerability
High 7.8
CVE-2022-37995 Windows Kernel Elevation of Privilege Vulnerability
High 7.8
CVE-2022-37997 Windows Graphics Component Elevation of Privilege Vulnerability
High 7.8
CVE-2022-37999 Windows Group Policy Preference Client Elevation of Privilege Vulnerability
High 7.8
CVE-2022-38003 Windows Resilient File System Elevation of Privilege
High 7.8
CVE-2022-38037 Windows Kernel Elevation of Privilege Vulnerability
EPSS 1.1%
High 7.8
CVE-2022-38038 Windows Kernel Elevation of Privilege Vulnerability
EPSS 1.1%
High 7.8
CVE-2022-38039 Windows Kernel Elevation of Privilege Vulnerability
High 7.8
CVE-2022-38044 Windows CD-ROM File System Driver Remote Code Execution Vulnerability
EPSS 56%
High 7.8
CVE-2022-38048 Microsoft Office Remote Code Execution Vulnerability
EPSS 1.7%
High 7.8
CVE-2022-38049 Microsoft Office Graphics Remote Code Execution Vulnerability
High 7.8
CVE-2022-38050 Win32k Elevation of Privilege Vulnerability
EPSS 7.3%
High 7.8
CVE-2022-38051 Windows Graphics Component Elevation of Privilege Vulnerability
EPSS 7.3%
High 7.8
CVE-2022-41031 Microsoft Word Remote Code Execution Vulnerability
High 7.8
CVE-2022-41083 Visual Studio Code Elevation of Privilege Vulnerability
High 7.7
CVE-2022-37973 Windows Local Session Manager (LSM) Denial of Service Vulnerability
EPSS 3.8%
High 7.7
CVE-2022-37998 Windows Local Session Manager (LSM) Denial of Service Vulnerability
EPSS 3.8%
High 7.5
CVE-2022-33645 Windows TCP/IP Driver Denial of Service Vulnerability
EPSS 2.6%
High 7.5
CVE-2022-34689 Windows CryptoAPI Spoofing Vulnerability
EPSS 38%
High 7.5
CVE-2022-37978 Windows Active Directory Certificate Services Security Feature Bypass
EPSS 1.8%
High 7.5
CVE-2022-38036 Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability
EPSS 2.7%
High 7.5
CVE-2022-38041 Windows Secure Channel Denial of Service Vulnerability
EPSS 2.6%
High 7.5
CVE-2022-38046 Web Account Manager Information Disclosure Vulnerability
EPSS 2.3%
High 7.4
CVE-2022-41042 Visual Studio Code Information Disclosure Vulnerability
EPSS 2.5%
High 7.1
CVE-2022-37971 Microsoft Windows Defender Elevation of Privilege Vulnerability
High 7.1
CVE-2022-38042 Active Directory Domain Services Elevation of Privilege Vulnerability
EPSS 1.8%
High 7.0
CVE-2022-38029 Public exploit Windows ALPC Elevation of Privilege Vulnerability
High 7.0
CVE-2022-38021 Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
High 7.0
CVE-2022-38027 Windows Storage Elevation of Privilege Vulnerability

Medium17 Show

Medium 6.8
CVE-2022-38017 StorSimple 8000 Series Elevation of Privilege Vulnerability
Medium 6.6
CVE-2022-38032 Windows Portable Device Enumerator Service Security Feature Bypass Vulnerability
Medium 6.5
CVE-2022-35770 Windows NTLM Spoofing Vulnerability
EPSS 2.1%
Medium 6.5
CVE-2022-37974 Windows Mixed Reality Developer Tools Information Disclosure Vulnerability
EPSS 36%
Medium 6.5
CVE-2022-37977 Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability
EPSS 2.3%
Medium 6.5
CVE-2022-38001 Microsoft Office Spoofing Vulnerability
EPSS 1.9%
Medium 6.5
CVE-2022-38033 Windows Server Remotely Accessible Registry Keys Information Disclosure Vulnerability
EPSS 2.1%
Medium 6.2
CVE-2022-35829 Service Fabric Explorer Spoofing Vulnerability
EPSS 19%
Medium 5.9
CVE-2022-37965 Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability
EPSS 1.9%
Medium 5.5
CVE-2022-37985 Windows Graphics Component Information Disclosure Vulnerability
EPSS 39%
Medium 5.5
CVE-2022-37996 Windows Kernel Memory Information Disclosure Vulnerability
Medium 5.5
CVE-2022-38025 Windows Distributed File System (DFS) Information Disclosure Vulnerability
Medium 5.5
CVE-2022-38026 Windows DHCP Client Information Disclosure Vulnerability
Medium 5.5
CVE-2022-38043 Windows Security Support Provider Interface Information Disclosure Vulnerability
Medium 5.3
CVE-2022-41035 Microsoft Edge (Chromium-based) Spoofing Vulnerability
EPSS 1.8%
Medium 4.3
CVE-2022-37981 Windows Event Logging Service Denial of Service Vulnerability
EPSS 2.9%
Medium 4.3
CVE-2022-38030 Windows USB Serial Driver Information Disclosure Vulnerability

Low2 Show