Microsoft · Security update · April 12, 2022

KB5012591: April 2022 cumulative update for Windows 10 1909

KB5012591, released April 12, 2022, fixes 67 CVEs across 3 products. 2 of them are being exploited (CVE-2022-26904); 2 on CISA KEV. Patch Radar priority: Patch now. The product is no longer supported.

Patch now2 on CISA KEVKnown ransomware use1 publicly disclosedUnsupported product

CVEs closed

8 rated Critical

Exploited

CVE-2022-26904

Exploitation more likely

Microsoft's assessment

Highest EPSS

0.9086

99th percentile

Priority of the 67 CVEs

Patch now 2
                                Urgent 14
                                High 47
                                Routine 4

Applies to

Product	Build after install
Windows 10 Version 1909 for 32-bit Systems	18363.2212
Windows 10 Version 1909 for ARM64-based Systems	18363.2212
Windows 10 Version 1909 for x64-based Systems	18363.2212

CVEs this fix closes

Priority	CVE	Component	Impact	CVSS	EPSS	Exploitation
Patch now	CVE-2022-26904	Windows User Profile Service	Elevation of Privilege	7.0	0.1695	KEVDisclosedExploited
Patch now	CVE-2022-24521	Windows Common Log File System Driver	Elevation of Privilege	7.8	0.0713	KEVRansomwareExploited
Urgent	CVE-2022-26809	Windows Remote Procedure Call Runtime	Remote Code Execution	9.8	0.9086	More likely
Urgent	CVE-2022-24500	Windows SMB	Remote Code Execution	8.8	0.3805	Exploitation Less Likely
Urgent	CVE-2022-24497	Windows Network File System	Remote Code Execution	9.8	0.3479	More likely
Urgent	CVE-2022-24491	Windows Network File System	Remote Code Execution	9.8	0.3347	More likely
Urgent	CVE-2022-24481	Windows Common Log File System Driver	Elevation of Privilege	7.8	0.1678	More likely
Urgent	CVE-2022-24542	Windows Win32K	Elevation of Privilege	7.8	0.0915	More likely
Urgent	CVE-2022-24474	Windows Win32K	Elevation of Privilege	7.8	0.0651	More likely
Urgent	CVE-2022-24547	Windows Media	Elevation of Privilege	7.8	0.0603	More likely
Urgent	CVE-2022-24541	Windows SMB	Remote Code Execution	8.8	0.0305	Exploitation Less Likely
Urgent	CVE-2022-26919	Windows LDAP - Lightweight Directory Access Protocol	Remote Code Execution	8.1	0.0257	Exploitation Less Likely
Urgent	CVE-2022-24546	Windows DWM Core Library	Elevation of Privilege	7.8	0.0082	More likely
Urgent	CVE-2022-26914	Windows Win32K	Elevation of Privilege	7.8	0.0082	More likely
Urgent	CVE-2022-22008	Role: Windows Hyper-V	Remote Code Execution	7.8	0.0042	Exploitation Less Likely
Urgent	CVE-2022-24537	Role: Windows Hyper-V	Remote Code Execution	7.8	0.0037	Exploitation Less Likely
High	CVE-2022-24533	Windows RDP	Remote Code Execution	8.0	0.0560	Exploitation Less Likely
High	CVE-2022-26826	Role: DNS Server	Remote Code Execution	7.2	0.0405	Exploitation Less Likely
High	CVE-2022-26915	Windows SChannel	Denial of Service	7.5	0.0356	Exploitation Less Likely
High	CVE-2022-26831	Windows LDAP - Lightweight Directory Access Protocol	Denial of Service	7.5	0.0327	Exploitation Less Likely
High	CVE-2022-24492	Windows Remote Procedure Call Runtime	Remote Code Execution	8.8	0.0309	Exploitation Less Likely
High	CVE-2022-26903	Microsoft Graphics Component	Remote Code Execution	7.8	0.0266	Exploitation Less Likely
High	CVE-2022-24528	Windows Remote Procedure Call Runtime	Remote Code Execution	8.8	0.0258	Exploitation Less Likely
High	CVE-2022-24487	Windows Local Security Authority Subsystem Service (LSASS)	Remote Code Execution	8.8	0.0222	Exploitation Less Likely
High	CVE-2022-24545	Windows Kerberos	Remote Code Execution	8.1	0.0221	Exploitation Less Likely

Released the same day

KB5002143
Microsoft Office 2016 (32-bit edition), Microsoft Office 2016 (64-bit edition)
KB5002148
Microsoft Office 2013 RT Service Pack 1, Microsoft Office 2013 Service Pack 1 (32-bit editions), Microsoft Office 2013 Service Pack 1 (64-bit editions)
KB5002162
Microsoft Office Online Server
KB5002169
Microsoft Office Web Apps Server 2013 Service Pack 1
KB5002175
Microsoft Excel 2013 RT Service Pack 1, Microsoft Excel 2013 Service Pack 1 (32-bit editions), Microsoft Excel 2013 Service Pack 1 (64-bit editions)
KB5002177
Microsoft Excel 2016 (32-bit edition), Microsoft Excel 2016 (64-bit edition)
KB5002180
Microsoft SharePoint Server 2019
KB5002183
Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2016
KB5002189
Microsoft SharePoint Foundation 2013 Service Pack 1
KB5002191
Microsoft SharePoint Server Subscription Edition
KB5012592
Windows 11 version 21H2 for ARM64-based Systems, Windows 11 version 21H2 for x64-based Systems
KB5012596
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 and 5 more

Vendor advisory

https://support.microsoft.com/help/5012591

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/microsoft/kb5012591">KB5012591 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which machines still need it?

Patchblox reads the OS build on every Windows machine, from Intune, ConfigMgr or its own agent, and shows which ones are still below the fixed build.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.