Microsoft Windows 10 21h1 vulnerabilities

83 CVEs affecting Microsoft Windows 10 21h1, 44 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-38257, published 2024-09-10.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-30190: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability, published 2022-06-01. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-06-14. EPSS: 99.2% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run…
• CVE-2021-40444: Microsoft MSHTML Remote Code Execution Vulnerability, published 2021-09-15. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 97.8% chance of exploitation in the next 30 days. Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability…
• CVE-2021-1675: Microsoft Windows Print Spooler Remote Code Execution Vulnerability, published 2021-06-08. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 85.3% chance of exploitation in the next 30 days. Windows Print Spooler Remote Code Execution Vulnerability
• CVE-2022-26923: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability, published 2022-05-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-08-18. EPSS: 83.5% chance of exploitation in the next 30 days. Active Directory Domain Services Elevation of Privilege Vulnerability
• CVE-2021-31955: Microsoft Windows Kernel Information Disclosure Vulnerability, published 2021-06-08. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 81.1% chance of exploitation in the next 30 days. Windows Kernel Information Disclosure Vulnerability
• CVE-2022-44698: Microsoft Defender SmartScreen Security Feature Bypass Vulnerability, published 2022-12-13. Medium severity, CVSS 5.4. Actively exploited: in CISA KEV since 2022-12-13. EPSS: 76.3% chance of exploitation in the next 30 days. Windows SmartScreen Security Feature Bypass Vulnerability
• CVE-2021-40449: Microsoft Windows Win32k Privilege Escalation Vulnerability, published 2021-10-13. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-17. EPSS: 74.1% chance of exploitation in the next 30 days. Win32k Elevation of Privilege Vulnerability
• CVE-2022-34713: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability, published 2022-08-09. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-08-09. EPSS: 67.8% chance of exploitation in the next 30 days. Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
• CVE-2021-36934: Microsoft Windows SAM Local Privilege Escalation Vulnerability, published 2021-07-22. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-02-10. EPSS: 67.3% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker…
• CVE-2021-33742: Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability, published 2021-06-08. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 59.4% chance of exploitation in the next 30 days. Windows MSHTML Platform Remote Code Execution Vulnerability

Latest

• CVE-2024-38257, published 2024-09-10. High severity, CVSS 7.5. EPSS: 4.5% chance of exploitation in the next 30 days. Microsoft AllJoyn API Information Disclosure Vulnerability
• CVE-2024-38256, published 2024-09-10. Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days. Windows Kernel-Mode Driver Information Disclosure Vulnerability
• CVE-2024-38254, published 2024-09-10. Medium severity, CVSS 6.2. EPSS: 0.7% chance of exploitation in the next 30 days. Windows Authentication Information Disclosure Vulnerability
• CVE-2024-38252, published 2024-09-10. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
• CVE-2024-38250, published 2024-09-10. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. Windows Graphics Component Elevation of Privilege Vulnerability
• CVE-2024-38119, published 2024-09-10. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
• CVE-2024-38046, published 2024-09-10. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. PowerShell Elevation of Privilege Vulnerability
• CVE-2024-30080, published 2024-06-11. Critical severity, CVSS 9.8. EPSS: 43.1% chance of exploitation in the next 30 days. Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
• CVE-2024-21420, published 2024-02-13. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
• CVE-2024-21357, published 2024-02-13. High severity, CVSS 8.1. EPSS: 26.9% chance of exploitation in the next 30 days. Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability