Microsoft · Security update · April 12, 2022

KB5012596: April 2022 cumulative update for Windows 10 1607

KB5012596, released April 12, 2022, fixes 86 CVEs across 8 products. 2 of them are being exploited (CVE-2022-26904); 2 on CISA KEV. Patch Radar priority: Patch now.

Patch now2 on CISA KEVKnown ransomware use1 publicly disclosed

CVEs closed

8 rated Critical

Exploited

CVE-2022-26904

Exploitation more likely

Microsoft's assessment

Highest EPSS

0.9086

99th percentile

Priority of the 86 CVEs

Patch now 2
                                Urgent 12
                                High 55
                                Routine 17

Applies to

Product	Build after install
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for 32-bit Systems	14393.5066
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for x64-based Systems	14393.5066
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016	14393.5066
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 (Server Core installation)	14393.5066
Windows 10 Version 1607 for 32-bit Systems	14393.5066
Windows 10 Version 1607 for x64-based Systems	14393.5066
Windows Server 2016	14393.5066
Windows Server 2016 (Server Core installation)	14393.5066

CVEs this fix closes

Priority	CVE	Component	Impact	CVSS	EPSS	Exploitation
Patch now	CVE-2022-26904	Windows User Profile Service	Elevation of Privilege	7.0	0.1695	KEVDisclosedExploited
Patch now	CVE-2022-24521	Windows Common Log File System Driver	Elevation of Privilege	7.8	0.0713	KEVRansomwareExploited
Urgent	CVE-2022-26809	Windows Remote Procedure Call Runtime	Remote Code Execution	9.8	0.9086	More likely
Urgent	CVE-2022-24500	Windows SMB	Remote Code Execution	8.8	0.3805	Exploitation Less Likely
Urgent	CVE-2022-24497	Windows Network File System	Remote Code Execution	9.8	0.3479	More likely
Urgent	CVE-2022-24491	Windows Network File System	Remote Code Execution	9.8	0.3347	More likely
Urgent	CVE-2022-24481	Windows Common Log File System Driver	Elevation of Privilege	7.8	0.1678	More likely
Urgent	CVE-2022-24542	Windows Win32K	Elevation of Privilege	7.8	0.0915	More likely
Urgent	CVE-2022-24474	Windows Win32K	Elevation of Privilege	7.8	0.0651	More likely
Urgent	CVE-2022-24547	Windows Media	Elevation of Privilege	7.8	0.0603	More likely
Urgent	CVE-2022-24541	Windows SMB	Remote Code Execution	8.8	0.0305	Exploitation Less Likely
Urgent	CVE-2022-26919	Windows LDAP - Lightweight Directory Access Protocol	Remote Code Execution	8.1	0.0257	Exploitation Less Likely
Urgent	CVE-2022-22008	Role: Windows Hyper-V	Remote Code Execution	7.8	0.0042	Exploitation Less Likely
Urgent	CVE-2022-24537	Role: Windows Hyper-V	Remote Code Execution	7.8	0.0037	Exploitation Less Likely
High	CVE-2022-24533	Windows RDP	Remote Code Execution	8.0	0.0560	Exploitation Less Likely
High	CVE-2022-26826	Role: DNS Server	Remote Code Execution	7.2	0.0405	Exploitation Less Likely
High	CVE-2022-24536	Role: DNS Server	Remote Code Execution	7.2	0.0384	Exploitation Less Likely
High	CVE-2022-26812	Role: DNS Server	Remote Code Execution	7.2	0.0384	Exploitation Less Likely
High	CVE-2022-26813	Role: DNS Server	Remote Code Execution	7.2	0.0384	Exploitation Less Likely
High	CVE-2022-26815	Role: DNS Server	Remote Code Execution	7.2	0.0384	Exploitation Less Likely
High	CVE-2022-26832	.NET Framework	Denial of Service	7.5	0.0361	Exploitation Less Likely
High	CVE-2022-26811	Role: DNS Server	Remote Code Execution	7.2	0.0358	Exploitation Less Likely
High	CVE-2022-26825	Role: DNS Server	Remote Code Execution	7.2	0.0358	Exploitation Less Likely
High	CVE-2022-26915	Windows SChannel	Denial of Service	7.5	0.0356	Exploitation Less Likely
High	CVE-2022-26823	Role: DNS Server	Remote Code Execution	7.2	0.0352	Exploitation Less Likely

Released the same day

KB5002143
Microsoft Office 2016 (32-bit edition), Microsoft Office 2016 (64-bit edition)
KB5002148
Microsoft Office 2013 RT Service Pack 1, Microsoft Office 2013 Service Pack 1 (32-bit editions), Microsoft Office 2013 Service Pack 1 (64-bit editions)
KB5002162
Microsoft Office Online Server
KB5002169
Microsoft Office Web Apps Server 2013 Service Pack 1
KB5002175
Microsoft Excel 2013 RT Service Pack 1, Microsoft Excel 2013 Service Pack 1 (32-bit editions), Microsoft Excel 2013 Service Pack 1 (64-bit editions)
KB5002177
Microsoft Excel 2016 (32-bit edition), Microsoft Excel 2016 (64-bit edition)
KB5002180
Microsoft SharePoint Server 2019
KB5002183
Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2016
KB5002189
Microsoft SharePoint Foundation 2013 Service Pack 1
KB5002191
Microsoft SharePoint Server Subscription Edition
KB5012591
Windows 10 Version 1909 for 32-bit Systems, Windows 10 Version 1909 for ARM64-based Systems, Windows 10 Version 1909 for x64-based Systems
KB5012592
Windows 11 version 21H2 for ARM64-based Systems, Windows 11 version 21H2 for x64-based Systems

Vendor advisory

https://support.microsoft.com/help/5012596

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/microsoft/kb5012596">KB5012596 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which machines still need it?

Patchblox reads the OS build on every Windows machine, from Intune, ConfigMgr or its own agent, and shows which ones are still below the fixed build.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.