Microsoft Windows 10 1909 vulnerabilities

47 CVEs affecting Microsoft Windows 10 1909, 44 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-38396, published 2023-02-12.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-0796: Microsoft SMBv3 Remote Code Execution Vulnerability, published 2020-03-12. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2022-02-10. EPSS: 99.8% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution…
• CVE-2021-40444: Microsoft MSHTML Remote Code Execution Vulnerability, published 2021-09-15. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 97.8% chance of exploitation in the next 30 days. Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability…
• CVE-2020-0601: Microsoft Windows CryptoAPI Spoofing Vulnerability, published 2020-01-14. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 89.4% chance of exploitation in the next 30 days. A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed…
• CVE-2021-1675: Microsoft Windows Print Spooler Remote Code Execution Vulnerability, published 2021-06-08. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 85.3% chance of exploitation in the next 30 days. Windows Print Spooler Remote Code Execution Vulnerability
• CVE-2022-26923: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability, published 2022-05-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-08-18. EPSS: 83.5% chance of exploitation in the next 30 days. Active Directory Domain Services Elevation of Privilege Vulnerability
• CVE-2021-31955: Microsoft Windows Kernel Information Disclosure Vulnerability, published 2021-06-08. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 81.1% chance of exploitation in the next 30 days. Windows Kernel Information Disclosure Vulnerability
• CVE-2021-1732: Microsoft Win32k Privilege Escalation Vulnerability, published 2021-02-25. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 78.4% chance of exploitation in the next 30 days. Windows Win32k Elevation of Privilege Vulnerability
• CVE-2021-40449: Microsoft Windows Win32k Privilege Escalation Vulnerability, published 2021-10-13. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-17. EPSS: 74.1% chance of exploitation in the next 30 days. Win32k Elevation of Privilege Vulnerability
• CVE-2020-0938: Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability, published 2020-04-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 69% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript…
• CVE-2021-36934: Microsoft Windows SAM Local Privilege Escalation Vulnerability, published 2021-07-22. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-02-10. EPSS: 67.3% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker…

Latest

• CVE-2022-38396, published 2023-02-12. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. HP Factory Preinstalled Images on certain systems that shipped with Windows 10 versions 20H2 and earlier OS versions might allow escalation of privilege via execution of certain files outside the…
• CVE-2022-26934, published 2022-05-10. Medium severity, CVSS 6.5. EPSS: 3.1% chance of exploitation in the next 30 days. Windows Graphics Component Information Disclosure Vulnerability
• CVE-2022-26925: Microsoft Windows LSA Spoofing Vulnerability, published 2022-05-10. Medium severity, CVSS 5.9. Actively exploited: in CISA KEV since 2022-07-01. EPSS: 10.5% chance of exploitation in the next 30 days. Windows LSA Spoofing Vulnerability
• CVE-2022-26904: Microsoft Windows User Profile Service Privilege Escalation Vulnerability, published 2022-04-15. High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2022-04-25. EPSS: 16.9% chance of exploitation in the next 30 days. Windows User Profile Service Elevation of Privilege Vulnerability
• CVE-2022-24521: Microsoft Windows CLFS Driver Privilege Escalation Vulnerability, published 2022-04-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-04-13. EPSS: 7.1% chance of exploitation in the next 30 days. Windows Common Log File System Driver Elevation of Privilege Vulnerability
• CVE-2022-22718: Microsoft Windows Print Spooler Privilege Escalation Vulnerability, published 2022-02-09. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-04-19. EPSS: 18.5% chance of exploitation in the next 30 days. Windows Print Spooler Elevation of Privilege Vulnerability
• CVE-2022-21999: Microsoft Windows Print Spooler Privilege Escalation Vulnerability, published 2022-02-09. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 41% chance of exploitation in the next 30 days. Windows Print Spooler Elevation of Privilege Vulnerability
• CVE-2022-21971: Microsoft Windows Runtime Remote Code Execution Vulnerability, published 2022-02-09. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-08-18. EPSS: 53.9% chance of exploitation in the next 30 days. Windows Runtime Remote Code Execution Vulnerability
• CVE-2022-21919: Microsoft Windows User Profile Service Privilege Escalation Vulnerability, published 2022-01-11. High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2022-04-25. EPSS: 2.4% chance of exploitation in the next 30 days. Windows User Profile Service Elevation of Privilege Vulnerability