Microsoft · Security update · April 9, 2024

KB5036925: April 2024 cumulative update for Windows 10 1507

KB5036925, released April 9, 2024, fixes 51 CVEs across 2 products. One of them is being exploited (CVE-2024-26234). Patch Radar priority: Patch now. The product is no longer supported.

Patch now1 publicly disclosedUnsupported product
CVEs closed
51
None rated Critical
Exploited
1
CVE-2024-26234
Exploitation more likely
7
Microsoft's assessment
Highest EPSS
0.2411
97th percentile

Priority of the 51 CVEs

Patch now 1 Urgent 7 High 26 Routine 17

Applies to

ProductBuild after install
Windows 10 for 32-bit Systems10240.20596
Windows 10 for x64-based Systems10240.20596

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2024-26234 Windows Proxy DriverSpoofing6.7 0.0485 DisclosedExploited
Urgent CVE-2024-26230 Windows Remote Access Connection ManagerElevation of Privilege7.8 0.2411 More likely
Urgent CVE-2024-26209 Windows Local Security Authority Subsystem Service (LSASS)Information Disclosure5.5 0.1481 More likely
Urgent CVE-2024-26158 Microsoft Install ServiceElevation of Privilege7.8 0.1226 More likely
Urgent CVE-2024-28921 Windows Secure BootSecurity Feature Bypass6.7 0.0073 More likely
Urgent CVE-2024-28903 Windows Secure BootSecurity Feature Bypass6.7 0.0073 More likely
Urgent CVE-2024-26241 Windows Win32K - ICOMPElevation of Privilege7.8 0.0073 More likely
Urgent CVE-2024-26239 Windows Remote Access Connection ManagerElevation of Privilege7.8 0.0058 More likely
High CVE-2024-26229 Windows KernelElevation of Privilege7.8 0.0938 Exploitation Less Likely
High CVE-2024-20678 Windows Remote Procedure CallRemote Code Execution8.8 0.0252 Exploitation Less Likely
High CVE-2024-26208 Windows Message QueuingRemote Code Execution7.2 0.0228 Exploitation Less Likely
High CVE-2024-26214 Microsoft WDAC ODBC DriverRemote Code Execution8.8 0.0202 Exploitation Less Likely
High CVE-2024-26210 Microsoft WDAC OLE DB provider for SQLRemote Code Execution8.8 0.0196 Exploitation Less Likely
High CVE-2024-26244 Microsoft WDAC OLE DB provider for SQLRemote Code Execution8.8 0.0196 Exploitation Less Likely
High CVE-2024-26179 Windows Routing and Remote Access Service (RRAS)Remote Code Execution8.8 0.0181 Exploitation Less Likely
High CVE-2024-26200 Windows Routing and Remote Access Service (RRAS)Remote Code Execution8.8 0.0181 Exploitation Less Likely
High CVE-2024-26205 Windows Routing and Remote Access Service (RRAS)Remote Code Execution8.8 0.0181 Exploitation Less Likely
High CVE-2024-26180 Windows Secure BootSecurity Feature Bypass8.0 0.0145 Exploitation Less Likely
High CVE-2024-26189 Windows Secure BootSecurity Feature Bypass8.0 0.0136 Exploitation Less Likely
High CVE-2024-29050 Windows Cryptographic ServicesRemote Code Execution8.4 0.0125 Exploitation Less Likely
High CVE-2024-28925 Windows Secure BootSecurity Feature Bypass8.0 0.0123 Exploitation Less Likely
High CVE-2024-26240 Windows Secure BootSecurity Feature Bypass8.0 0.0106 Exploitation Less Likely
High CVE-2024-26248 Windows KerberosElevation of Privilege7.5 0.0103 Exploitation Less Likely
High CVE-2024-28896 Windows Secure BootSecurity Feature Bypass7.5 0.0095 Exploitation Less Likely
High CVE-2024-26232 Windows Message QueuingRemote Code Execution7.3 0.0093 Exploitation Less Likely
Showing 1 to 25 of 51 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.