Microsoft · Security update · March 8, 2022

KB5011497: March 2022 cumulative update for Windows Server 2022

KB5011497, released March 8, 2022, fixes 29 CVEs across 4 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent2 publicly disclosed

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Microsoft's assessment

Highest EPSS

0.5638

99th percentile

Priority of the 29 CVEs

Patch now 0
                                Urgent 9
                                High 13
                                Routine 7

Applies to

Product	Build after install
Microsoft Defender for Endpoint for Windows on Windows Server 2022	20348.587
Microsoft Defender for Endpoint for Windows on Windows Server 2022 (Server Core installation)	20348.587
Windows Server 2022	20348.587
Windows Server 2022 (Server Core installation)	20348.587

CVEs this fix closes

Priority	CVE	Component	Impact	CVSS	EPSS	Exploitation
Urgent	CVE-2022-23253	Windows Point-to-Point Tunneling Protocol	Denial of Service	6.5	0.5638	More likely
Urgent	CVE-2022-24502	Windows HTML Platform	Security Feature Bypass	4.3	0.3306	More likely
Urgent	CVE-2022-23285	Windows Remote Desktop	Remote Code Execution	8.8	0.2563	More likely
Urgent	CVE-2022-21990	Windows Remote Desktop	Remote Code Execution	8.8	0.1884	DisclosedMore likely
Urgent	CVE-2022-23299	Windows PDEV	Elevation of Privilege	7.8	0.0762	More likely
Urgent	CVE-2022-23286	Windows Cloud Files Mini Filter Driver	Elevation of Privilege	7.0	0.0430	More likely
Urgent	CVE-2022-24507	Windows Ancillary Function Driver for WinSock	Elevation of Privilege	7.8	0.0387	More likely
Urgent	CVE-2022-24508	Windows SMB Server	Remote Code Execution	8.8	0.0255	More likely
Urgent	CVE-2022-23294	Windows Event Tracing	Remote Code Execution	8.8	0.0230	More likely
High	CVE-2022-23284	Windows Print Spooler Components	Elevation of Privilege	7.2	0.0317	Exploitation Less Likely
High	CVE-2022-24460	Tablet Windows User Interface	Elevation of Privilege	7.0	0.0201	Exploitation Less Likely
High	CVE-2022-23293	Windows Fast FAT Driver	Elevation of Privilege	7.8	0.0067	Exploitation Less Likely
High	CVE-2022-23296	Windows Installer	Elevation of Privilege	7.8	0.0067	Exploitation Less Likely
High	CVE-2022-23291	Windows DWM Core Library	Elevation of Privilege	7.8	0.0064	Exploitation Less Likely
High	CVE-2022-24459	Windows Fax and Scan Service	Elevation of Privilege	7.8	0.0064	DisclosedExploitation Less Likely
High	CVE-2022-23290	Windows COM	Elevation of Privilege	7.8	0.0063	Exploitation Less Likely
High	CVE-2022-24454	Windows Security Support Provider Interface	Elevation of Privilege	7.8	0.0063	Exploitation Less Likely
High	CVE-2022-23287	Windows ALPC	Elevation of Privilege	7.0	0.0058	Exploitation Less Likely
High	CVE-2022-23288	Windows DWM Core Library	Elevation of Privilege	7.0	0.0058	Exploitation Less Likely
High	CVE-2022-23298	Windows Kernel	Elevation of Privilege	7.0	0.0058	Exploitation Less Likely
High	CVE-2022-23283	Windows ALPC	Elevation of Privilege	7.0	0.0039	Exploitation Less Likely
High	CVE-2022-24505	Windows ALPC	Elevation of Privilege	7.0	0.0036	Exploitation Less Likely
Routine	CVE-2022-22010	Microsoft Windows Codecs Library	Information Disclosure	4.4	0.0263	Exploitation Less Likely
Routine	CVE-2022-21977	Microsoft Windows Codecs Library	Information Disclosure	3.3	0.0253	Exploitation Less Likely
Routine	CVE-2022-24503	Windows Remote Desktop	Information Disclosure	5.4	0.0244	Exploitation Less Likely

Released the same day

KB5002068
Microsoft Word 2013 RT Service Pack 1, Microsoft Word 2013 Service Pack 1 (32-bit editions), Microsoft Word 2013 Service Pack 1 (64-bit editions)
KB5002139
Microsoft Word 2016 (32-bit edition), Microsoft Word 2016 (64-bit edition)
KB5010324
Microsoft Exchange Server 2013 Cumulative Update 23
KB5011485
Microsoft Defender for Endpoint for Windows on Windows 10 Version 1909 for 32-bit Systems, Microsoft Defender for Endpoint for Windows on Windows 10 Version 1909 for ARM64-based Systems, Microsoft Defender for Endpoint for Windows on Windows 10 Version 1909 for x64-based Systems and 3 more
KB5011486
Windows 7 for 32-bit Systems Service Pack 1, Windows 7 for x64-based Systems Service Pack 1, Windows 8.1 for 32-bit systems and 6 more
KB5011487
Microsoft Defender for Endpoint for Windows on Windows 10 Version 20H2 for 32-bit Systems, Microsoft Defender for Endpoint for Windows on Windows 10 Version 20H2 for ARM64-based Systems, Microsoft Defender for Endpoint for Windows on Windows 10 Version 21H1 for 32-bit Systems and 15 more
KB5011491
Windows 10 for 32-bit Systems, Windows 10 for x64-based Systems
KB5011493
Microsoft Defender for Endpoint for Windows on Windows 11 version 21H2 for ARM64-based Systems, Microsoft Defender for Endpoint for Windows on Windows 11 version 21H2 for x64-based Systems, Windows 11 version 21H2 for ARM64-based Systems and 1 more
KB5011495
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows Server 2016 and 1 more
KB5011503
Microsoft Defender for Endpoint for Windows on Windows 10 Version 1809 for 32-bit Systems, Microsoft Defender for Endpoint for Windows on Windows 10 Version 1809 for ARM64-based Systems, Microsoft Defender for Endpoint for Windows on Windows 10 Version 1809 for x64-based Systems and 7 more
KB5011525
Windows Server 2008 for 32-bit Systems Service Pack 2, Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation), Windows Server 2008 for x64-based Systems Service Pack 2 and 1 more
KB5011527
Windows Server 2012, Windows Server 2012 (Server Core installation)

Vendor advisory

https://support.microsoft.com/help/5011497

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/microsoft/kb5011497">KB5011497 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which machines still need it?

Patchblox reads the OS build on every Windows machine, from Intune, ConfigMgr or its own agent, and shows which ones are still below the fixed build.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.