Microsoft · Security update · May 10, 2022

KB5014001: May 2022 security update

KB5014001, released May 10, 2022, fixes 45 CVEs across 4 products. 2 of them are being exploited (CVE-2022-26923); 2 on CISA KEV. Patch Radar priority: Patch now.

Patch now2 on CISA KEV1 publicly disclosed
CVEs closed
45
5 rated Critical
Exploited
2
CVE-2022-26923
Exploitation more likely
5
Microsoft's assessment
Highest EPSS
0.8350
99th percentile

Priority of the 45 CVEs

Patch now 2 Urgent 7 High 21 Routine 15

Applies to

Product
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2022-26923 Windows Active DirectoryElevation of Privilege8.8 0.8350 KEVExploited
Patch now CVE-2022-26925 Microsoft Local Security Authority Server (lsasrv)Spoofing8.1 0.1048 KEVDisclosedExploited
Urgent CVE-2022-21972 Windows Point-to-Point Tunneling ProtocolRemote Code Execution8.1 0.7935 Exploitation Less Likely
Urgent CVE-2022-26937 Windows Network File SystemRemote Code Execution9.8 0.7597 More likely
Urgent CVE-2022-23270 Windows Point-to-Point Tunneling ProtocolRemote Code Execution8.1 0.7035 More likely
Urgent CVE-2022-29104 Windows Print Spooler ComponentsElevation of Privilege7.8 0.1176 More likely
Urgent CVE-2022-26931 Windows KerberosElevation of Privilege7.5 0.0269 Exploitation Less Likely
Urgent CVE-2022-29114 Windows Print Spooler ComponentsInformation Disclosure5.5 0.0132 More likely
Urgent CVE-2022-29132 Windows Print Spooler ComponentsElevation of Privilege7.8 0.0071 More likely
High CVE-2022-22012 Windows LDAP - Lightweight Directory Access ProtocolRemote Code Execution9.8 0.0418 Exploitation Less Likely
High CVE-2022-29130 Windows LDAP - Lightweight Directory Access ProtocolRemote Code Execution9.8 0.0393 Exploitation Less Likely
High CVE-2022-29128 Windows LDAP - Lightweight Directory Access ProtocolRemote Code Execution8.8 0.0290 Exploitation Less Likely
High CVE-2022-29129 Windows LDAP - Lightweight Directory Access ProtocolRemote Code Execution8.8 0.0290 Exploitation Less Likely
High CVE-2022-29141 Windows LDAP - Lightweight Directory Access ProtocolRemote Code Execution8.8 0.0283 Exploitation Less Likely
High CVE-2022-29105 Windows MediaRemote Code Execution7.8 0.0283 Exploitation Less Likely
High CVE-2022-26926 Windows Address BookRemote Code Execution7.8 0.0281 Exploitation Less Likely
High CVE-2022-22019 Windows Remote Procedure Call RuntimeRemote Code Execution8.8 0.0272 Exploitation Less Likely
High CVE-2022-22013 Windows LDAP - Lightweight Directory Access ProtocolRemote Code Execution8.8 0.0248 Exploitation Less Likely
High CVE-2022-22014 Windows LDAP - Lightweight Directory Access ProtocolRemote Code Execution8.8 0.0248 Exploitation Less Likely
High CVE-2022-29137 Windows LDAP - Lightweight Directory Access ProtocolRemote Code Execution8.8 0.0248 Exploitation Less Likely
High CVE-2022-29139 Windows LDAP - Lightweight Directory Access ProtocolRemote Code Execution8.8 0.0243 Exploitation Less Likely
High CVE-2022-29115 Role: Windows Fax ServiceRemote Code Execution7.8 0.0241 Exploitation Less Likely
High CVE-2022-30138 Windows Print Spooler ComponentsElevation of Privilege7.8 0.0103 Exploitation Less Likely
High CVE-2022-29125 Windows Push NotificationsElevation of Privilege7.0 0.0076 Exploitation Less Likely
High CVE-2022-29135 Windows Cluster Shared Volume (CSV)Elevation of Privilege7.0 0.0074 Exploitation Less Likely
Showing 1 to 25 of 45 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.