Patch days / November 2022

Microsoft Patch Tuesday — November 2022

Tuesday, 8 November 2022

Vulnerabilities: 62
Critical: 0
High: 45
Zero-days: 4
Public exploit: 3

Exploited 6

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

High 8.8
CVE-2022-41080 Exploited Public exploit Microsoft Exchange Server Elevation of Privilege Vulnerability
EPSS 77%
High 8.8
CVE-2022-41128 Zero-day Windows Scripting Languages Remote Code Execution Vulnerability
EPSS 25%
High 7.8
CVE-2022-41073 Zero-day Windows Print Spooler Elevation of Privilege Vulnerability
EPSS 2.6%
High 7.8
CVE-2022-41125 Zero-day Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
EPSS 3%
Medium 5.4
CVE-2022-41049 Exploited Windows Mark of the Web Security Feature Bypass Vulnerability
EPSS 3.3%
Medium 5.4
CVE-2022-41091 Zero-day Windows Mark of the Web Security Feature Bypass Vulnerability
EPSS 2.3%

Public exploit code 2

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

High 7.0
CVE-2022-41114 Public exploit Windows Bind Filter Driver Elevation of Privilege Vulnerability
Medium 4.6
CVE-2022-41099 Public exploit BitLocker Security Feature Bypass Vulnerability
EPSS 4.5%

All vulnerabilities 62

High45 Show

High 8.8
CVE-2022-41080 Exploited Public exploit Microsoft Exchange Server Elevation of Privilege Vulnerability
EPSS 77%
High 8.8
CVE-2022-41128 Zero-day Windows Scripting Languages Remote Code Execution Vulnerability
EPSS 25%
High 7.8
CVE-2022-41073 Zero-day Windows Print Spooler Elevation of Privilege Vulnerability
EPSS 2.6%
High 7.8
CVE-2022-41125 Zero-day Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
EPSS 3%
High 8.8
CVE-2022-41047 Microsoft ODBC Driver Remote Code Execution Vulnerability
EPSS 1.9%
High 8.8
CVE-2022-41048 Microsoft ODBC Driver Remote Code Execution Vulnerability
EPSS 1.9%
High 8.8
CVE-2022-41062 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 2%
High 8.8
CVE-2022-41106 Microsoft Excel Remote Code Execution Vulnerability
EPSS 2.8%
High 8.1
CVE-2022-37966 Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability
EPSS 2.9%
High 8.1
CVE-2022-38023 Netlogon RPC Elevation of Privilege Vulnerability
EPSS 2.7%
High 8.1
CVE-2022-41039 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.4%
High 8.1
CVE-2022-41044 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.3%
High 8.1
CVE-2022-41088 Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.3%
High 8.0
CVE-2022-41078 Microsoft Exchange Server Spoofing Vulnerability
High 8.0
CVE-2022-41079 Microsoft Exchange Server Spoofing Vulnerability
High 7.8
CVE-2022-37992 Windows Group Policy Elevation of Privilege Vulnerability
High 7.8
CVE-2022-41045 Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
High 7.8
CVE-2022-41050 Windows Extensible File Allocation Table Elevation of Privilege Vulnerability
High 7.8
CVE-2022-41051 Azure RTOS GUIX Studio Remote Code Execution Vulnerability
High 7.8
CVE-2022-41052 Windows Graphics Component Remote Code Execution Vulnerability
High 7.8
CVE-2022-41054 Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
High 7.8
CVE-2022-41057 Windows HTTP.sys Elevation of Privilege Vulnerability
EPSS 1.3%
High 7.8
CVE-2022-41061 Microsoft Word Remote Code Execution Vulnerability
EPSS 1.3%
High 7.8
CVE-2022-41063 Microsoft Excel Remote Code Execution Vulnerability
High 7.8
CVE-2022-41092 Windows Win32k Elevation of Privilege Vulnerability
High 7.8
CVE-2022-41093 Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
High 7.8
CVE-2022-41095 Windows Digital Media Receiver Elevation of Privilege Vulnerability
High 7.8
CVE-2022-41096 Microsoft DWM Core Library Elevation of Privilege Vulnerability
High 7.8
CVE-2022-41100 Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
High 7.8
CVE-2022-41101 Windows Overlay Filter Elevation of Privilege Vulnerability
High 7.8
CVE-2022-41102 Windows Overlay Filter Elevation of Privilege Vulnerability
High 7.8
CVE-2022-41107 Microsoft Office Graphics Remote Code Execution Vulnerability
High 7.8
CVE-2022-41109 Windows Win32k Elevation of Privilege Vulnerability
EPSS 8.1%
High 7.8
CVE-2022-41113 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
EPSS 8.1%
High 7.8
CVE-2022-41119 Visual Studio Remote Code Execution Vulnerability
High 7.8
CVE-2022-41120 Microsoft Windows System Monitor (Sysmon) Elevation of Privilege Vulnerability
EPSS 1.2%
High 7.8
CVE-2022-41123 Microsoft Exchange Server Elevation of Privilege Vulnerability
High 7.5
CVE-2022-41053 Windows Kerberos Denial of Service Vulnerability
EPSS 2.5%
High 7.5
CVE-2022-41056 Network Policy Server (NPS) RADIUS Protocol Denial of Service Vulnerability
EPSS 2.5%
High 7.5
CVE-2022-41058 Windows Network Address Translation (NAT) Denial of Service Vulnerability
EPSS 2.5%
High 7.5
CVE-2022-41085 Azure CycleCloud Elevation of Privilege Vulnerability
High 7.5
CVE-2022-41118 Windows Scripting Languages Remote Code Execution Vulnerability
EPSS 1.4%
High 7.2
CVE-2022-37967 Windows Kerberos Elevation of Privilege Vulnerability
EPSS 4.8%
High 7.0
CVE-2022-41114 Public exploit Windows Bind Filter Driver Elevation of Privilege Vulnerability
High 7.0
CVE-2022-38014 Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability

Medium17 Show

Medium 5.4
CVE-2022-41049 Exploited Windows Mark of the Web Security Feature Bypass Vulnerability
EPSS 3.3%
Medium 5.4
CVE-2022-41091 Zero-day Windows Mark of the Web Security Feature Bypass Vulnerability
EPSS 2.3%
Medium 6.5
CVE-2022-38015 Windows Hyper-V Denial of Service Vulnerability
Medium 6.5
CVE-2022-41097 Network Policy Server (NPS) RADIUS Protocol Information Disclosure Vulnerability
EPSS 2%
Medium 6.5
CVE-2022-41122 Microsoft SharePoint Server Spoofing Vulnerability
EPSS 2%
Medium 6.4
CVE-2022-41086 Windows Group Policy Elevation of Privilege Vulnerability
Medium 5.9
CVE-2022-41090 Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability
EPSS 1.3%
Medium 5.9
CVE-2022-41116 Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability
EPSS 1.3%
Medium 5.8
CVE-2022-41064 .NET Framework Information Disclosure Vulnerability
Medium 5.5
CVE-2022-41055 Windows Human Interface Device Information Disclosure Vulnerability
Medium 5.5
CVE-2022-41060 Microsoft Word Information Disclosure Vulnerability
Medium 5.5
CVE-2022-41098 Windows GDI+ Information Disclosure Vulnerability
Medium 5.5
CVE-2022-41103 Microsoft Word Information Disclosure Vulnerability
EPSS 1%
Medium 5.5
CVE-2022-41104 Microsoft Excel Security Feature Bypass Vulnerability
Medium 5.5
CVE-2022-41105 Microsoft Excel Information Disclosure Vulnerability
Medium 4.6
CVE-2022-41099 Public exploit BitLocker Security Feature Bypass Vulnerability
EPSS 4.5%
Medium 4.4
CVE-2022-41066 Microsoft Dynamics Business Central Information Disclosure Vulnerability
EPSS 1.5%