Patch days / February 2023

Microsoft Patch Tuesday — February 2023

Tuesday, 14 February 2023

Vulnerabilities: 78
Critical: 5
High: 55
Zero-days: 3
Public exploit: 5

Exploited 4

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

High 8.8
CVE-2023-21529 Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 59%
High 7.8
CVE-2023-21823 Zero-day Public exploit Windows Graphics Component Remote Code Execution Vulnerability
EPSS 5.6%
High 7.8
CVE-2023-23376 Zero-day Windows Common Log File System Driver Elevation of Privilege Vulnerability
EPSS 11%
High 7.3
CVE-2023-21715 Zero-day Microsoft Publisher Security Feature Bypass Vulnerability
EPSS 12%

Critical 5

Critical 9.8
CVE-2023-21716 Public exploit Microsoft Word Remote Code Execution Vulnerability
EPSS 85%
Critical 9.8
CVE-2023-21689 Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
EPSS 27%
Critical 9.8
CVE-2023-21690 Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
EPSS 28%
Critical 9.8
CVE-2023-21692 Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
EPSS 21%
Critical 9.8
CVE-2023-21803 Windows iSCSI Discovery Service Remote Code Execution Vulnerability
EPSS 1.8%

Public exploit code 3

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

High 8.8
CVE-2023-21707 Public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 80%
High 7.8
CVE-2023-21688 Public exploit NT OS Kernel Elevation of Privilege Vulnerability
EPSS 3.6%
High 7.8
CVE-2023-21817 Public exploit Windows Kerberos Elevation of Privilege Vulnerability

All vulnerabilities 78

Critical5 Show

Critical 9.8
CVE-2023-21716 Public exploit Microsoft Word Remote Code Execution Vulnerability
EPSS 85%
Critical 9.8
CVE-2023-21689 Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
EPSS 27%
Critical 9.8
CVE-2023-21690 Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
EPSS 28%
Critical 9.8
CVE-2023-21692 Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
EPSS 21%
Critical 9.8
CVE-2023-21803 Windows iSCSI Discovery Service Remote Code Execution Vulnerability
EPSS 1.8%

High55 Show

High 8.8
CVE-2023-21529 Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 59%
High 7.8
CVE-2023-21823 Zero-day Public exploit Windows Graphics Component Remote Code Execution Vulnerability
EPSS 5.6%
High 7.8
CVE-2023-23376 Zero-day Windows Common Log File System Driver Elevation of Privilege Vulnerability
EPSS 11%
High 7.3
CVE-2023-21715 Zero-day Microsoft Publisher Security Feature Bypass Vulnerability
EPSS 12%
High 8.8
CVE-2023-21707 Public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 80%
High 8.8
CVE-2023-21684 Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
EPSS 1.3%
High 8.8
CVE-2023-21685 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 1.2%
High 8.8
CVE-2023-21686 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 1.2%
High 8.8
CVE-2023-21705 Microsoft SQL Server Remote Code Execution Vulnerability
EPSS 1.1%
High 8.8
CVE-2023-21706 Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 4.1%
High 8.8
CVE-2023-21713 Microsoft SQL Server Remote Code Execution Vulnerability
EPSS 1.8%
High 8.8
CVE-2023-21717 Microsoft SharePoint Server Elevation of Privilege Vulnerability
EPSS 1.1%
High 8.8
CVE-2023-21797 Microsoft ODBC Driver Remote Code Execution Vulnerability
EPSS 1.2%
High 8.8
CVE-2023-21798 Microsoft ODBC Driver Remote Code Execution Vulnerability
EPSS 1.2%
High 8.8
CVE-2023-21799 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 1.2%
High 8.7
CVE-2023-21777 Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
High 8.3
CVE-2023-23374 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
EPSS 1.1%
High 8.2
CVE-2023-21806 Power BI Report Server Spoofing Vulnerability
High 8.0
CVE-2023-21778 Microsoft Dynamics Unified Service Desk Remote Code Execution Vulnerability
High 7.8
CVE-2023-21688 Public exploit NT OS Kernel Elevation of Privilege Vulnerability
EPSS 3.6%
High 7.8
CVE-2023-21817 Public exploit Windows Kerberos Elevation of Privilege Vulnerability
High 7.8
CVE-2023-21528 Microsoft SQL Server Remote Code Execution Vulnerability
High 7.8
CVE-2023-21566 Visual Studio Elevation of Privilege Vulnerability
High 7.8
CVE-2023-21704 Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
High 7.8
CVE-2023-21718 Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
High 7.8
CVE-2023-21800 Windows Installer Elevation of Privilege Vulnerability
EPSS 1.1%
High 7.8
CVE-2023-21801 Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
High 7.8
CVE-2023-21802 Windows Media Remote Code Execution Vulnerability
High 7.8
CVE-2023-21804 Windows Graphics Component Elevation of Privilege Vulnerability
High 7.8
CVE-2023-21805 Windows MSHTML Platform Remote Code Execution Vulnerability
High 7.8
CVE-2023-21808 .NET and Visual Studio Remote Code Execution Vulnerability
EPSS 1.1%
High 7.8
CVE-2023-21809 Microsoft Defender for Endpoint Security Feature Bypass Vulnerability
High 7.8
CVE-2023-21812 Windows Common Log File System Driver Elevation of Privilege Vulnerability
EPSS 3.3%
High 7.8
CVE-2023-21815 Visual Studio Remote Code Execution Vulnerability
High 7.8
CVE-2023-21822 Windows Graphics Component Elevation of Privilege Vulnerability
High 7.8
CVE-2023-23377 3D Builder Remote Code Execution Vulnerability
High 7.8
CVE-2023-23378 Print 3D Remote Code Execution Vulnerability
High 7.8
CVE-2023-23379 Microsoft Defender for IoT Elevation of Privilege Vulnerability
High 7.8
CVE-2023-23381 Visual Studio Remote Code Execution Vulnerability
High 7.8
CVE-2023-23390 3D Builder Remote Code Execution Vulnerability
High 7.5
CVE-2023-21553 Azure DevOps Server Remote Code Execution Vulnerability
EPSS 1.4%
High 7.5
CVE-2023-21691 Microsoft Protected Extensible Authentication Protocol (PEAP) Information Disclosure Vulnerability
EPSS 1.4%
High 7.5
CVE-2023-21695 Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
EPSS 1.1%
High 7.5
CVE-2023-21700 Windows iSCSI Discovery Service Denial of Service Vulnerability
EPSS 1.7%
High 7.5
CVE-2023-21701 Microsoft Protected Extensible Authentication Protocol (PEAP) Denial of Service Vulnerability
EPSS 1.7%
High 7.5
CVE-2023-21702 Windows iSCSI Service Denial of Service Vulnerability
EPSS 1.7%
High 7.5
CVE-2023-21811 Windows iSCSI Service Denial of Service Vulnerability
EPSS 1.7%
High 7.5
CVE-2023-21813 Windows Secure Channel Denial of Service Vulnerability
EPSS 1.7%
High 7.5
CVE-2023-21816 Windows Active Directory Domain Services API Denial of Service Vulnerability
EPSS 1.7%
High 7.5
CVE-2023-21818 Windows Secure Channel Denial of Service Vulnerability
EPSS 43%
High 7.5
CVE-2023-21819 Windows Secure Channel Denial of Service Vulnerability
EPSS 31%
High 7.4
CVE-2023-21820 Windows Distributed File System (DFS) Remote Code Execution Vulnerability
High 7.3
CVE-2023-21568 Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability
High 7.2
CVE-2023-21710 Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 7.9%
High 7.1
CVE-2023-21564 Azure DevOps Server Cross-Site Scripting Vulnerability

Medium18 Show

Medium 6.8
CVE-2023-21694 Windows Fax Service Remote Code Execution Vulnerability
Medium 6.5
CVE-2023-21572 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Medium 6.5
CVE-2023-21703 Azure Data Box Gateway Remote Code Execution Vulnerability
EPSS 1.5%
Medium 6.5
CVE-2023-21721 Microsoft OneNote Elevation of Privilege Vulnerability
Medium 6.5
CVE-2023-21807 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Medium 6.5
CVE-2023-23382 Azure Machine Learning Compute Instance Information Disclosure Vulnerability
EPSS 2.7%
Medium 6.2
CVE-2023-21697 Windows Internet Storage Name Service (iSNS) Server Information Disclosure Vulnerability
Medium 5.7
CVE-2023-21693 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
EPSS 1.4%
Medium 5.6
CVE-2023-21567 Visual Studio Denial of Service Vulnerability
Medium 5.5
CVE-2023-21687 HTTP.sys Information Disclosure Vulnerability
Medium 5.5
CVE-2023-21714 Microsoft Office Information Disclosure Vulnerability
Medium 5.4
CVE-2023-21570 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Medium 5.4
CVE-2023-21571 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Medium 5.4
CVE-2023-21573 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Medium 5.3
CVE-2023-21699 Windows Internet Storage Name Service (iSNS) Server Information Disclosure Vulnerability
EPSS 1.1%
Medium 5.3
CVE-2023-21720 Microsoft Edge (Chromium-based) Tampering Vulnerability
EPSS 1.2%
Medium 5.0
CVE-2023-21722 .NET Framework Denial of Service Vulnerability
Medium 4.3
CVE-2023-21794 Microsoft Edge (Chromium-based) Spoofing Vulnerability