Skip to content
CVE Tracker
Back

CVE-2022-22012

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

Critical9.8EPSS 4.2%
Published
Updated
Reserved
Assigned by
microsoft

Description

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

Scores

CVSS scores of CVE-2022-22012, by who scored it
Scored byCVSSScoreVector
microsoftCNA (assigner)3.1Critical9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
NVDNVD · Modified3.1Critical9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
4.2% · top 9.1% of all CVEs (2 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

  • Remote Code Execution

Affected products

  • Microsoft · Windows 10 Version 1809

    • affected 10.0.17763.0 – < 10.0.17763.2928

  • Microsoft · Windows 10 Version 1809

    • affected 10.0.0 – < 10.0.17763.2928

  • Microsoft · Windows Server 2019

    • affected 10.0.17763.0 – < 10.0.17763.2928

  • Microsoft · Windows Server 2019 (Server Core installation)

    • affected 10.0.17763.0 – < 10.0.17763.2928

  • Microsoft · Windows 10 Version 1909

    • affected 10.0.0 – < 10.0.18363.2274

  • Microsoft · Windows 10 Version 21H1

    • affected 10.0.0 – < 10.0.19043.1706

  • Microsoft · Windows Server 2022

    • affected 10.0.20348.0 – < 10.0.20348.707

  • Microsoft · Windows 10 Version 20H2

    • affected 10.0.0 – < 10.0.19042.1706

  • Microsoft · Windows Server version 20H2

    • affected 10.0.0 – < 10.0.19042.1706

  • Microsoft · Windows 11 version 21H2

    • affected 10.0.0 – < 10.0.22000.675

  • Microsoft · Windows 10 Version 21H2

    • affected 10.0.19043.0 – < 10.0.19043.1706

  • Microsoft · Windows 10 Version 1507

    • affected 10.0.10240.0 – < 10.0.10240.19297

  • Microsoft · Windows 10 Version 1607

    • affected 10.0.14393.0 – < 10.0.14393.5125

  • Microsoft · Windows Server 2016

    • affected 10.0.14393.0 – < 10.0.14393.5125

  • Microsoft · Windows Server 2016 (Server Core installation)

    • affected 10.0.14393.0 – < 10.0.14393.5125

  • Microsoft · Windows 7

    • affected 6.1.0 – < 6.1.7601.25954

  • Microsoft · Windows 7 Service Pack 1

    • affected 6.1.0 – < 6.1.7601.25954

  • Microsoft · Windows 8.1

    • affected 6.3.0 – < 6.3.9600.20371

  • Microsoft · Windows Server 2008 Service Pack 2

    • affected 6.0.6003.0 – < 6.0.6003.21481

  • Microsoft · Windows Server 2008 Service Pack 2 (Server Core installation)

    • affected 6.0.6003.0 – < 6.0.6003.21481

  • Microsoft · Windows Server 2008 Service Pack 2

    • affected 6.0.6003.0 – < 6.0.6003.21481

  • Microsoft · Windows Server 2008 R2 Service Pack 1

    • affected 6.1.7601.0 – < 6.1.7601.25954

  • Microsoft · Windows Server 2008 R2 Service Pack 1 (Server Core installation)

    • affected 6.1.7601.0 – < 6.1.7601.25954

  • Microsoft · Windows Server 2012

    • affected 6.2.9200.0 – < 6.2.9200.23714

  • Microsoft · Windows Server 2012 (Server Core installation)

    • affected 6.2.9200.0 – < 6.2.9200.23714

  • Microsoft · Windows Server 2012 R2

    • affected 6.3.9600.0 – < 6.3.9600.20371

  • Microsoft · Windows Server 2012 R2 (Server Core installation)

    • affected 6.3.9600.0 – < 6.3.9600.20371

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .