Microsoft Patch Tuesday — September 2023

Tuesday, 12 September 2023

Vulnerabilities: 59
Critical: 0
High: 47
Zero-days: 2
Public exploit: 3

Exploited 2

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

High 7.8
CVE-2023-36802 Zero-day Public exploit Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
EPSS 28%
Medium 6.5
CVE-2023-36761 Zero-day Microsoft Word Information Disclosure Vulnerability
EPSS 20%

Public exploit code 2

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

High 8.8
CVE-2023-38146 Public exploit Windows Themes Remote Code Execution Vulnerability
EPSS 37%
High 8.0
CVE-2023-36745 Public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 76%

All vulnerabilities 59

High47 Show

High 7.8
CVE-2023-36802 Zero-day Public exploit Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
EPSS 28%
High 8.8
CVE-2023-38146 Public exploit Windows Themes Remote Code Execution Vulnerability
EPSS 37%
High 8.8
CVE-2023-33136 Azure DevOps Server Remote Code Execution Vulnerability
EPSS 1.7%
High 8.8
CVE-2023-36764 Microsoft SharePoint Server Elevation of Privilege Vulnerability
EPSS 2.1%
High 8.8
CVE-2023-38147 Windows Miracast Wireless Display Remote Code Execution Vulnerability
High 8.8
CVE-2023-38148 Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
EPSS 7.7%
High 8.0
CVE-2023-36745 Public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 76%
High 8.0
CVE-2023-36744 Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 57%
High 8.0
CVE-2023-36756 Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 49%
High 8.0
CVE-2023-36757 Microsoft Exchange Server Spoofing Vulnerability
EPSS 37%
High 7.8
CVE-2023-35355 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
High 7.8
CVE-2023-36739 3D Viewer Remote Code Execution Vulnerability
High 7.8
CVE-2023-36740 3D Viewer Remote Code Execution Vulnerability
High 7.8
CVE-2023-36742 Visual Studio Code Remote Code Execution Vulnerability
EPSS 1%
High 7.8
CVE-2023-36758 Visual Studio Elevation of Privilege Vulnerability
EPSS 1.3%
High 7.8
CVE-2023-36760 3D Viewer Remote Code Execution Vulnerability
High 7.8
CVE-2023-36765 Microsoft Office Elevation of Privilege Vulnerability
High 7.8
CVE-2023-36766 Microsoft Excel Information Disclosure Vulnerability
EPSS 1.2%
High 7.8
CVE-2023-36770 3D Builder Remote Code Execution Vulnerability
High 7.8
CVE-2023-36771 3D Builder Remote Code Execution Vulnerability
High 7.8
CVE-2023-36772 3D Builder Remote Code Execution Vulnerability
High 7.8
CVE-2023-36773 3D Builder Remote Code Execution Vulnerability
High 7.8
CVE-2023-36788 .NET Framework Remote Code Execution Vulnerability
EPSS 1%
High 7.8
CVE-2023-36792 Visual Studio Remote Code Execution Vulnerability
EPSS 1.2%
High 7.8
CVE-2023-36793 Visual Studio Remote Code Execution Vulnerability
EPSS 1.2%
High 7.8
CVE-2023-36794 Visual Studio Remote Code Execution Vulnerability
EPSS 1.2%
High 7.8
CVE-2023-36796 Visual Studio Remote Code Execution Vulnerability
EPSS 1.2%
High 7.8
CVE-2023-36804 Windows GDI Elevation of Privilege Vulnerability
High 7.8
CVE-2023-38139 Windows Kernel Elevation of Privilege Vulnerability
High 7.8
CVE-2023-38141 Windows Kernel Elevation of Privilege Vulnerability
High 7.8
CVE-2023-38142 Windows Kernel Elevation of Privilege Vulnerability
EPSS 5.6%
High 7.8
CVE-2023-38143 Windows Common Log File System Driver Elevation of Privilege Vulnerability
EPSS 3.4%
High 7.8
CVE-2023-38144 Windows Common Log File System Driver Elevation of Privilege Vulnerability
EPSS 3.4%
High 7.8
CVE-2023-38150 Windows Kernel Elevation of Privilege Vulnerability
High 7.8
CVE-2023-38161 Windows GDI Elevation of Privilege Vulnerability
High 7.8
CVE-2023-38163 Windows Defender Attack Surface Reduction Security Feature Bypass
High 7.6
CVE-2023-36800 Dynamics Finance and Operations Cross-site Scripting Vulnerability
High 7.6
CVE-2023-36886 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
High 7.6
CVE-2023-38164 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
High 7.5
CVE-2023-29332 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
EPSS 2.7%
High 7.5
CVE-2023-36763 Microsoft Outlook Information Disclosure Vulnerability
EPSS 2.1%
High 7.5
CVE-2023-38149 Windows TCP/IP Denial of Service Vulnerability
EPSS 4.5%
High 7.5
CVE-2023-38162 DHCP Server Service Denial of Service Vulnerability
EPSS 11%
High 7.3
CVE-2023-36762 Microsoft Word Remote Code Execution Vulnerability
High 7.2
CVE-2023-38156 Azure HDInsight Apache Ambari JDBC Injection Elevation of Privilege Vulnerability
EPSS 2%
High 7.0
CVE-2023-36805 Windows MSHTML Platform Security Feature Bypass Vulnerability
EPSS 1.8%
High 7.0
CVE-2023-38155 Azure DevOps Server Remote Code Execution Vulnerability
EPSS 1.3%

Medium12 Show

Medium 6.5
CVE-2023-36761 Zero-day Microsoft Word Information Disclosure Vulnerability
EPSS 20%
Medium 6.7
CVE-2023-36759 Visual Studio Elevation of Privilege Vulnerability
Medium 6.5
CVE-2023-36799 .NET Core and Visual Studio Denial of Service Vulnerability
EPSS 4.6%
Medium 5.7
CVE-2023-36777 Microsoft Exchange Server Information Disclosure Vulnerability
EPSS 52%
Medium 5.5
CVE-2023-36803 Windows Kernel Information Disclosure Vulnerability
Medium 5.5
CVE-2023-38140 Windows Kernel Information Disclosure Vulnerability
EPSS 1.1%
Medium 5.5
CVE-2023-38160 Windows TCP/IP Information Disclosure Vulnerability
Medium 5.5
CVE-2023-41764 Microsoft Office Spoofing Vulnerability
EPSS 1%
Medium 5.3
CVE-2023-36801 DHCP Server Service Information Disclosure Vulnerability
EPSS 1.6%
Medium 5.3
CVE-2023-38152 DHCP Server Service Information Disclosure Vulnerability
EPSS 24%
Medium 4.4
CVE-2023-36736 Microsoft Identity Linux Broker Remote Code Execution Vulnerability
EPSS 1.4%
Medium 4.3
CVE-2023-36767 Microsoft Office Security Feature Bypass Vulnerability
EPSS 3.1%