Microsoft Windows 10 20h2 vulnerabilities

283 CVEs affecting Microsoft Windows 10 20h2, 54 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-44684, published 2023-12-20.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-31166: Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability, published 2021-05-11. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-04-06. EPSS: 99.9% chance of exploitation in the next 30 days. HTTP Protocol Stack Remote Code Execution Vulnerability
• CVE-2021-34527: Microsoft Windows Print Spooler Remote Code Execution Vulnerability, published 2021-07-02. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.8% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run…
• CVE-2022-30190: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability, published 2022-06-01. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-06-14. EPSS: 99.2% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run…
• CVE-2021-40444: Microsoft MSHTML Remote Code Execution Vulnerability, published 2021-09-15. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 97.8% chance of exploitation in the next 30 days. Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability…
• CVE-2021-1675: Microsoft Windows Print Spooler Remote Code Execution Vulnerability, published 2021-06-08. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 85.3% chance of exploitation in the next 30 days. Windows Print Spooler Remote Code Execution Vulnerability
• CVE-2022-26923: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability, published 2022-05-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-08-18. EPSS: 83.5% chance of exploitation in the next 30 days. Active Directory Domain Services Elevation of Privilege Vulnerability
• CVE-2021-31955: Microsoft Windows Kernel Information Disclosure Vulnerability, published 2021-06-08. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 81.1% chance of exploitation in the next 30 days. Windows Kernel Information Disclosure Vulnerability
• CVE-2021-1732: Microsoft Win32k Privilege Escalation Vulnerability, published 2021-02-25. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 78.4% chance of exploitation in the next 30 days. Windows Win32k Elevation of Privilege Vulnerability
• CVE-2023-24880: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability, published 2023-03-14. Medium severity, CVSS 4.4. Actively exploited: in CISA KEV since 2023-03-14. EPSS: 78% chance of exploitation in the next 30 days. Windows SmartScreen Security Feature Bypass Vulnerability
• CVE-2022-44698: Microsoft Defender SmartScreen Security Feature Bypass Vulnerability, published 2022-12-13. Medium severity, CVSS 5.4. Actively exploited: in CISA KEV since 2022-12-13. EPSS: 76.3% chance of exploitation in the next 30 days. Windows SmartScreen Security Feature Bypass Vulnerability

Latest

• CVE-2022-44684, published 2023-12-20. Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days. Windows Local Session Manager (LSM) Denial of Service Vulnerability
• CVE-2022-35759, published 2023-05-31. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. Windows Local Security Authority (LSA) Denial of Service Vulnerability
• CVE-2022-35758, published 2023-05-31. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. Windows Kernel Memory Information Disclosure Vulnerability
• CVE-2022-35757, published 2023-05-31. High severity, CVSS 7.3. EPSS: 0.8% chance of exploitation in the next 30 days. Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
• CVE-2022-35756, published 2023-05-31. High severity, CVSS 7.8. EPSS: 11.3% chance of exploitation in the next 30 days. Windows Kerberos Elevation of Privilege Vulnerability
• CVE-2022-35755, published 2023-05-31. High severity, CVSS 7.3. EPSS: 9.8% chance of exploitation in the next 30 days. Windows Print Spooler Elevation of Privilege Vulnerability
• CVE-2022-35753, published 2023-05-31. High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days. Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
• CVE-2022-35752, published 2023-05-31. High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days. Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
• CVE-2022-35751, published 2023-05-31. High severity, CVSS 7.8. EPSS: 5.5% chance of exploitation in the next 30 days. Windows Hyper-V Elevation of Privilege Vulnerability
• CVE-2022-35750, published 2023-05-31. High severity, CVSS 7.8. EPSS: 6.5% chance of exploitation in the next 30 days. Win32k Elevation of Privilege Vulnerability