Microsoft · Security update · May 10, 2022

KB5013963: May 2022 cumulative update for Windows 10 1507

KB5013963, released May 10, 2022, fixes 36 CVEs across 2 products. 2 of them are being exploited (CVE-2022-26923); 2 on CISA KEV. Patch Radar priority: Patch now. The product is no longer supported.

Patch now2 on CISA KEV1 publicly disclosedUnsupported product
CVEs closed
36
4 rated Critical
Exploited
2
CVE-2022-26923
Exploitation more likely
4
Microsoft's assessment
Highest EPSS
0.8350
99th percentile

Priority of the 36 CVEs

Patch now 2 Urgent 6 High 18 Routine 10

Applies to

ProductBuild after install
Windows 10 for 32-bit Systems10240.19297
Windows 10 for x64-based Systems10240.19297

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2022-26923 Windows Active DirectoryElevation of Privilege8.8 0.8350 KEVExploited
Patch now CVE-2022-26925 Microsoft Local Security Authority Server (lsasrv)Spoofing8.1 0.1048 KEVDisclosedExploited
Urgent CVE-2022-21972 Windows Point-to-Point Tunneling ProtocolRemote Code Execution8.1 0.7935 Exploitation Less Likely
Urgent CVE-2022-23270 Windows Point-to-Point Tunneling ProtocolRemote Code Execution8.1 0.7035 More likely
Urgent CVE-2022-29104 Windows Print Spooler ComponentsElevation of Privilege7.8 0.1176 More likely
Urgent CVE-2022-26931 Windows KerberosElevation of Privilege7.5 0.0269 Exploitation Less Likely
Urgent CVE-2022-29114 Windows Print Spooler ComponentsInformation Disclosure5.5 0.0132 More likely
Urgent CVE-2022-29132 Windows Print Spooler ComponentsElevation of Privilege7.8 0.0071 More likely
High CVE-2022-22012 Windows LDAP - Lightweight Directory Access ProtocolRemote Code Execution9.8 0.0418 Exploitation Less Likely
High CVE-2022-29130 Windows LDAP - Lightweight Directory Access ProtocolRemote Code Execution9.8 0.0393 Exploitation Less Likely
High CVE-2022-29128 Windows LDAP - Lightweight Directory Access ProtocolRemote Code Execution8.8 0.0290 Exploitation Less Likely
High CVE-2022-29129 Windows LDAP - Lightweight Directory Access ProtocolRemote Code Execution8.8 0.0290 Exploitation Less Likely
High CVE-2022-29141 Windows LDAP - Lightweight Directory Access ProtocolRemote Code Execution8.8 0.0283 Exploitation Less Likely
High CVE-2022-29105 Windows MediaRemote Code Execution7.8 0.0283 Exploitation Less Likely
High CVE-2022-26926 Windows Address BookRemote Code Execution7.8 0.0281 Exploitation Less Likely
High CVE-2022-22019 Windows Remote Procedure Call RuntimeRemote Code Execution8.8 0.0272 Exploitation Less Likely
High CVE-2022-22013 Windows LDAP - Lightweight Directory Access ProtocolRemote Code Execution8.8 0.0248 Exploitation Less Likely
High CVE-2022-22014 Windows LDAP - Lightweight Directory Access ProtocolRemote Code Execution8.8 0.0248 Exploitation Less Likely
High CVE-2022-29137 Windows LDAP - Lightweight Directory Access ProtocolRemote Code Execution8.8 0.0248 Exploitation Less Likely
High CVE-2022-29139 Windows LDAP - Lightweight Directory Access ProtocolRemote Code Execution8.8 0.0243 Exploitation Less Likely
High CVE-2022-29115 Role: Windows Fax ServiceRemote Code Execution7.8 0.0241 Exploitation Less Likely
High CVE-2022-30138 Windows Print Spooler ComponentsElevation of Privilege7.8 0.0103 Exploitation Less Likely
High CVE-2022-29125 Windows Push NotificationsElevation of Privilege7.0 0.0076 Exploitation Less Likely
High CVE-2022-29103 Windows Remote Access Connection ManagerElevation of Privilege7.8 0.0064 Exploitation Less Likely
High CVE-2022-29126 Tablet Windows User InterfaceElevation of Privilege7.0 0.0064 Exploitation Less Likely
Showing 1 to 25 of 36 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.