Microsoft · Security update · August 9, 2022

KB5016616: August 2022 cumulative update for Windows 10 20H2

KB5016616, released August 9, 2022, fixes 62 CVEs across 9 products. One of them is being exploited (CVE-2022-34713); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV1 publicly disclosed

CVEs closed

13 rated Critical

Exploited

CVE-2022-34713

Exploitation more likely

Microsoft's assessment

Highest EPSS

0.6776

99th percentile

Priority of the 62 CVEs

Patch now 1
                                Urgent 28
                                High 22
                                Routine 11

Applies to

Product
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows Server, version 20H2 (Server Core Installation)

CVEs this fix closes

Priority	CVE	Component	Impact	CVSS	EPSS	Exploitation
Patch now	CVE-2022-34713	Microsoft Windows Support Diagnostic Tool (MSDT)	Remote Code Execution	7.8	0.6776	KEVDisclosedExploited
Urgent	CVE-2022-35748	Windows Internet Information Services	Denial of Service	7.5	0.4723	More likely
Urgent	CVE-2022-34689	Windows CryptoAPI	Spoofing	7.5	0.3814	More likely
Urgent	CVE-2022-35756	Windows Kerberos	Elevation of Privilege	7.8	0.1131	More likely
Urgent	CVE-2022-35755	Windows Print Spooler Components	Elevation of Privilege	7.3	0.0980	More likely
Urgent	CVE-2022-35793	Windows Print Spooler Components	Elevation of Privilege	7.3	0.0936	More likely
Urgent	CVE-2022-35750	Windows Canonical Display Driver	Elevation of Privilege	7.8	0.0648	More likely
Urgent	CVE-2022-35751	Role: Windows Hyper-V	Elevation of Privilege	7.8	0.0546	More likely
Urgent	CVE-2022-34699	Windows Win32K	Elevation of Privilege	7.8	0.0447	More likely
Urgent	CVE-2022-35761	Windows Kernel	Elevation of Privilege	7.8	0.0413	More likely
Urgent	CVE-2022-30133	Windows Point-to-Point Tunneling Protocol	Remote Code Execution	9.8	0.0281	Exploitation Less Likely
Urgent	CVE-2022-34691	Active Directory Domain Services	Elevation of Privilege	8.8	0.0237	Exploitation Less Likely
Urgent	CVE-2022-34714	Windows Secure Socket Tunneling Protocol (SSTP)	Remote Code Execution	8.1	0.0201	Exploitation Less Likely
Urgent	CVE-2022-35744	Windows Point-to-Point Tunneling Protocol	Remote Code Execution	9.8	0.0198	Exploitation Less Likely
Urgent	CVE-2022-35794	Windows Secure Socket Tunneling Protocol (SSTP)	Remote Code Execution	8.1	0.0195	Exploitation Less Likely
Urgent	CVE-2022-35766	Windows Secure Socket Tunneling Protocol (SSTP)	Remote Code Execution	8.1	0.0181	Exploitation Less Likely
Urgent	CVE-2022-35767	Windows Secure Socket Tunneling Protocol (SSTP)	Remote Code Execution	8.1	0.0181	Exploitation Less Likely
Urgent	CVE-2022-35743	Microsoft Windows Support Diagnostic Tool (MSDT)	Remote Code Execution	7.8	0.0145	More likely
Urgent	CVE-2022-34702	Windows Secure Socket Tunneling Protocol (SSTP)	Remote Code Execution	8.1	0.0131	Exploitation Less Likely
Urgent	CVE-2022-35745	Windows Secure Socket Tunneling Protocol (SSTP)	Remote Code Execution	8.1	0.0123	Exploitation Less Likely
Urgent	CVE-2022-35752	Remote Access Service Point-to-Point Tunneling Protocol	Remote Code Execution	8.1	0.0123	Exploitation Less Likely
Urgent	CVE-2022-35753	Remote Access Service Point-to-Point Tunneling Protocol	Remote Code Execution	8.1	0.0123	Exploitation Less Likely
Urgent	CVE-2022-34302	Windows Secure Boot	Security Feature Bypass	7.5	0.0109	More likely
Urgent	CVE-2022-34301	Windows Secure Boot	Security Feature Bypass	7.2	0.0099	More likely
Urgent	CVE-2022-34303	Windows Secure Boot	Security Feature Bypass	7.2	0.0086	More likely

Released the same day

KB4462142
Microsoft Office 2013 RT Service Pack 1, Microsoft Office 2013 Service Pack 1 (32-bit editions), Microsoft Office 2013 Service Pack 1 (64-bit editions)
KB4462148
Microsoft Office 2016 (32-bit edition), Microsoft Office 2016 (64-bit edition)
KB5001990
Microsoft Outlook 2013 RT Service Pack 1, Microsoft Outlook 2013 Service Pack 1 (32-bit editions), Microsoft Outlook 2013 Service Pack 1 (64-bit editions)
KB5002051
Microsoft Outlook 2016 (32-bit edition), Microsoft Outlook 2016 (64-bit edition)
KB5002228
Microsoft Office Online Server
KB5002232
Microsoft Excel 2016 (32-bit edition), Microsoft Excel 2016 (64-bit edition)
KB5002242
Microsoft Excel 2013 RT Service Pack 1, Microsoft Excel 2013 Service Pack 1 (32-bit editions), Microsoft Excel 2013 Service Pack 1 (64-bit editions)
KB5012170
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems and 29 more
KB5015322
Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 11 and 1 more
KB5016314
Microsoft Visual Studio 2012 Update 5
KB5016315
Microsoft Visual Studio 2013 Update 5
KB5016316
Microsoft Visual Studio 2015 Update 3

Vendor advisory

https://support.microsoft.com/help/5016616

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/microsoft/kb5016616">KB5016616 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which machines still need it?

Patchblox reads the OS build on every Windows machine, from Intune, ConfigMgr or its own agent, and shows which ones are still below the fixed build.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.