Microsoft · Security update · July 13, 2021

KB5004238: July 2021 cumulative update for Windows 10 1607

KB5004238, released July 13, 2021, fixes 59 CVEs across 4 products. 3 of them are being exploited (CVE-2021-34448); 3 on CISA KEV. Patch Radar priority: Patch now.

Patch now3 on CISA KEV2 publicly disclosed
CVEs closed
59
5 rated Critical
Exploited
3
CVE-2021-34448
Exploitation more likely
1
Microsoft's assessment
Highest EPSS
0.4006
98th percentile

Priority of the 59 CVEs

Patch now 3 Urgent 5 High 33 Routine 18

Applies to

ProductBuild after install
Windows 10 Version 1607 for 32-bit Systems14393.4530
Windows 10 Version 1607 for x64-based Systems14393.4530
Windows Server 201614393.4530
Windows Server 2016 (Server Core installation)14393.4530

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2021-34448 Microsoft Scripting EngineRemote Code Execution6.8 0.4006 KEVExploited
Patch now CVE-2021-33771 Windows KernelElevation of Privilege7.8 0.1017 KEVExploited
Patch now CVE-2021-31979 Windows KernelElevation of Privilege7.8 0.0454 KEVExploited
Urgent CVE-2021-34494 Role: DNS ServerRemote Code Execution8.8 0.0405 Exploitation Less Likely
Urgent CVE-2021-33780 Role: DNS ServerRemote Code Execution8.8 0.0271 More likely
Urgent CVE-2021-34439 Microsoft Windows Media FoundationRemote Code Execution7.8 0.0267 Exploitation Less Likely
Urgent CVE-2021-34458 Windows KernelRemote Code Execution9.9 0.0263 Exploitation Less Likely
Urgent CVE-2021-34497 Windows MSHTML PlatformRemote Code Execution6.8 0.0215 Exploitation Less Likely
High CVE-2020-17049 Microsoft WindowsSecurity Feature Bypass7.2 0.1379 Exploitation Less Likely
High CVE-2021-31183 Windows TCP/IPDenial of Service7.5 0.0384 Exploitation Less Likely
High CVE-2021-34504 Windows Address BookRemote Code Execution7.8 0.0347 Exploitation Less Likely
High CVE-2021-33788 Windows Local Security Authority Subsystem Service (LSASS)Denial of Service7.5 0.0328 Exploitation Less Likely
High CVE-2021-34476 Common Internet File SystemDenial of Service7.5 0.0328 Exploitation Less Likely
High CVE-2021-34442 Role: DNS ServerRemote Code Execution8.8 0.0317 Exploitation Less Likely
High CVE-2021-33758 Role: Windows Hyper-VDenial of Service7.7 0.0287 Exploitation Less Likely
High CVE-2021-34492 Windows PFX EncryptionSpoofing8.1 0.0247 DisclosedExploitation Less Likely
High CVE-2021-33779 Active Directory Federation ServicesSecurity Feature Bypass8.1 0.0244 DisclosedExploitation Less Likely
High CVE-2021-33749 Role: DNS ServerRemote Code Execution8.8 0.0242 Exploitation Less Likely
High CVE-2021-33750 Role: DNS ServerRemote Code Execution8.8 0.0242 Exploitation Less Likely
High CVE-2021-33752 Role: DNS ServerRemote Code Execution8.8 0.0242 Exploitation Less Likely
High CVE-2021-33756 Role: DNS ServerRemote Code Execution8.8 0.0241 Exploitation Less Likely
High CVE-2021-34525 Role: DNS ServerRemote Code Execution8.8 0.0225 Exploitation Less Likely
High CVE-2021-34441 Microsoft Windows Media FoundationRemote Code Execution7.8 0.0222 Exploitation Less Likely
High CVE-2021-33786 Windows Local Security Authority Subsystem Service (LSASS)Security Feature Bypass8.1 0.0212 Exploitation Less Likely
High CVE-2021-34446 Windows HTML PlatformSecurity Feature Bypass8.0 0.0205 Exploitation Less Likely
Showing 1 to 25 of 59 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.