Microsoft Patch Tuesday — October 2023

Tuesday, 10 October 2023

Vulnerabilities: 103
Critical: 2
High: 83
Zero-days: 2
Public exploit: 2

Exploited 3

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

Medium 6.5
CVE-2023-36563 Zero-day Microsoft WordPad Information Disclosure Vulnerability
EPSS 20%
Medium 5.4
CVE-2023-36584 Exploited Windows Mark of the Web Security Feature Bypass Vulnerability
EPSS 3.3%
Medium 5.3
CVE-2023-41763 Zero-day Skype for Business Elevation of Privilege Vulnerability
EPSS 90%

Critical 2

Critical 9.8
CVE-2023-35349 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
EPSS 2.9%
Critical 9.8
CVE-2023-36434 Windows IIS Server Elevation of Privilege Vulnerability
EPSS 2.3%

Public exploit code 2

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

High 7.8
CVE-2023-36723 Public exploit Windows Container Manager Service Elevation of Privilege Vulnerability
EPSS 2%
High 7.8
CVE-2023-41772 Public exploit Win32k Elevation of Privilege Vulnerability
EPSS 13%

All vulnerabilities 103

Critical2 Show

Critical 9.8
CVE-2023-35349 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
EPSS 2.9%
Critical 9.8
CVE-2023-36434 Windows IIS Server Elevation of Privilege Vulnerability
EPSS 2.3%

High83 Show

High 8.8
CVE-2023-36414 Azure Identity SDK Remote Code Execution Vulnerability
EPSS 2.4%
High 8.8
CVE-2023-36415 Azure Identity SDK Remote Code Execution Vulnerability
EPSS 1.8%
High 8.8
CVE-2023-36419 Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability
EPSS 1.8%
High 8.8
CVE-2023-36577 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 1.8%
High 8.4
CVE-2023-36569 Microsoft Office Elevation of Privilege Vulnerability
High 8.1
CVE-2023-38166 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.3%
High 8.1
CVE-2023-41765 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.3%
High 8.1
CVE-2023-41767 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.3%
High 8.1
CVE-2023-41768 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.3%
High 8.1
CVE-2023-41769 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.3%
High 8.1
CVE-2023-41770 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.3%
High 8.1
CVE-2023-41771 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.3%
High 8.1
CVE-2023-41773 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.3%
High 8.1
CVE-2023-41774 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
EPSS 1.3%
High 8.0
CVE-2023-36778 Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 1.7%
High 7.8
CVE-2023-36723 Public exploit Windows Container Manager Service Elevation of Privilege Vulnerability
EPSS 2%
High 7.8
CVE-2023-41772 Public exploit Win32k Elevation of Privilege Vulnerability
EPSS 13%
High 7.8
CVE-2023-36417 Microsoft SQL OLE DB Remote Code Execution Vulnerability
High 7.8
CVE-2023-36418 Azure RTOS GUIX Studio Remote Code Execution Vulnerability
High 7.8
CVE-2023-36420 Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
High 7.8
CVE-2023-36436 Windows MSHTML Platform Remote Code Execution Vulnerability
High 7.8
CVE-2023-36557 PrintHTML API Remote Code Execution Vulnerability
High 7.8
CVE-2023-36593 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
High 7.8
CVE-2023-36594 Windows Graphics Component Elevation of Privilege Vulnerability
EPSS 8%
High 7.8
CVE-2023-36598 Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability
High 7.8
CVE-2023-36701 Microsoft Resilient File System (ReFS) Elevation of Privilege Vulnerability
High 7.8
CVE-2023-36702 Microsoft DirectMusic Remote Code Execution Vulnerability
High 7.8
CVE-2023-36704 Windows Setup Files Cleanup Remote Code Execution Vulnerability
High 7.8
CVE-2023-36710 Windows Media Foundation Core Remote Code Execution Vulnerability
High 7.8
CVE-2023-36711 Windows Runtime C++ Template Library Elevation of Privilege Vulnerability
High 7.8
CVE-2023-36712 Windows Kernel Elevation of Privilege Vulnerability
High 7.8
CVE-2023-36718 Microsoft Virtual Trusted Platform Module Remote Code Execution Vulnerability
EPSS 1.3%
High 7.8
CVE-2023-36725 Windows Kernel Elevation of Privilege Vulnerability
High 7.8
CVE-2023-36726 Windows Internet Key Exchange (IKE) Extension Elevation of Privilege Vulnerability
High 7.8
CVE-2023-36729 Named Pipe File System Elevation of Privilege Vulnerability
High 7.8
CVE-2023-36730 Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
High 7.8
CVE-2023-36731 Win32k Elevation of Privilege Vulnerability
EPSS 6.6%
High 7.8
CVE-2023-36732 Win32k Elevation of Privilege Vulnerability
High 7.8
CVE-2023-36737 Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
High 7.8
CVE-2023-36743 Win32k Elevation of Privilege Vulnerability
EPSS 3.6%
High 7.8
CVE-2023-36785 Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
High 7.8
CVE-2023-36790 Windows RDP Encoder Mirror Driver Elevation of Privilege Vulnerability
High 7.8
CVE-2023-41766 Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
High 7.5
CVE-2023-29348 Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability
EPSS 2.1%
High 7.5
CVE-2023-36431 Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
EPSS 2.5%
High 7.5
CVE-2023-36435 Microsoft QUIC Denial of Service Vulnerability
EPSS 5.7%
High 7.5
CVE-2023-36438 Windows TCP/IP Information Disclosure Vulnerability
EPSS 2%
High 7.5
CVE-2023-36567 Windows Deployment Services Information Disclosure Vulnerability
EPSS 2.1%
High 7.5
CVE-2023-36579 Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
EPSS 2.5%
High 7.5
CVE-2023-36581 Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
EPSS 2.5%
High 7.5
CVE-2023-36585 Windows upnphost.dll Denial of Service Vulnerability
EPSS 2.6%
High 7.5
CVE-2023-36596 Remote Procedure Call Information Disclosure Vulnerability
EPSS 2.1%
High 7.5
CVE-2023-36602 Windows TCP/IP Denial of Service Vulnerability
EPSS 2.5%
High 7.5
CVE-2023-36603 Windows TCP/IP Denial of Service Vulnerability
EPSS 2.5%
High 7.5
CVE-2023-36606 Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
EPSS 69%
High 7.5
CVE-2023-36703 DHCP Server Service Denial of Service Vulnerability
EPSS 2.5%
High 7.5
CVE-2023-36709 Microsoft AllJoyn API Denial of Service Vulnerability
EPSS 2.7%
High 7.5
CVE-2023-36720 Windows Mixed Reality Developer Tools Denial of Service Vulnerability
EPSS 2.5%
High 7.5
CVE-2023-38171 Microsoft QUIC Denial of Service Vulnerability
EPSS 71%
High 7.4
CVE-2023-36605 Windows Named Pipe Filesystem Elevation of Privilege Vulnerability
High 7.3
CVE-2023-36561 Azure DevOps Server Elevation of Privilege Vulnerability
High 7.3
CVE-2023-36570 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
High 7.3
CVE-2023-36571 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
High 7.3
CVE-2023-36572 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
High 7.3
CVE-2023-36573 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
High 7.3
CVE-2023-36574 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
High 7.3
CVE-2023-36575 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
High 7.3
CVE-2023-36578 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
High 7.3
CVE-2023-36582 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
High 7.3
CVE-2023-36583 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
High 7.3
CVE-2023-36589 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
High 7.3
CVE-2023-36590 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
High 7.3
CVE-2023-36591 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
High 7.3
CVE-2023-36592 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
High 7.2
CVE-2023-36780 Skype for Business Remote Code Execution Vulnerability
EPSS 2.7%
High 7.2
CVE-2023-36786 Skype for Business Remote Code Execution Vulnerability
EPSS 2.6%
High 7.2
CVE-2023-36789 Skype for Business Remote Code Execution Vulnerability
EPSS 2.5%
High 7.0
CVE-2023-36565 Microsoft Office Graphics Elevation of Privilege Vulnerability
High 7.0
CVE-2023-36568 Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
High 7.0
CVE-2023-36721 Windows Error Reporting Service Elevation of Privilege Vulnerability
High 7.0
CVE-2023-36776 Win32k Elevation of Privilege Vulnerability
EPSS 2.1%
High 7.0
CVE-2023-36902 Windows Runtime Remote Code Execution Vulnerability
High 7.0
CVE-2023-38159 Windows Graphics Component Elevation of Privilege Vulnerability
EPSS 4.1%

Medium18 Show

Medium 6.5
CVE-2023-36563 Zero-day Microsoft WordPad Information Disclosure Vulnerability
EPSS 20%
Medium 5.4
CVE-2023-36584 Exploited Windows Mark of the Web Security Feature Bypass Vulnerability
EPSS 3.3%
Medium 5.3
CVE-2023-41763 Zero-day Skype for Business Elevation of Privilege Vulnerability
EPSS 90%
Medium 6.8
CVE-2023-36697 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
EPSS 2.2%
Medium 6.5
CVE-2023-36429 Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
EPSS 2.2%
Medium 6.5
CVE-2023-36433 Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
EPSS 2.2%
Medium 6.5
CVE-2023-36564 Windows Search Security Feature Bypass Vulnerability
EPSS 1.4%
Medium 6.5
CVE-2023-36566 Microsoft Common Data Model SDK Denial of Service Vulnerability
EPSS 3%
Medium 6.5
CVE-2023-36706 Windows Deployment Services Information Disclosure Vulnerability
EPSS 2%
Medium 6.5
CVE-2023-36707 Windows Deployment Services Denial of Service Vulnerability
EPSS 2.7%
Medium 6.5
CVE-2023-36717 Windows Virtual Trusted Platform Module Denial of Service Vulnerability
Medium 6.1
CVE-2023-36416 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Medium 5.5
CVE-2023-36576 Windows Kernel Information Disclosure Vulnerability
Medium 5.5
CVE-2023-36713 Windows Common Log File System Driver Information Disclosure Vulnerability
EPSS 6.8%
Medium 5.5
CVE-2023-36724 Windows Power Management Service Information Disclosure Vulnerability
Medium 5.5
CVE-2023-36728 Microsoft SQL Server Denial of Service Vulnerability
Medium 4.4
CVE-2023-36698 Windows Kernel Security Feature Bypass Vulnerability
Medium 4.4
CVE-2023-36722 Active Directory Domain Services Information Disclosure Vulnerability
EPSS 1.4%

Most affected products

Windows Server 2022 78 · 2 crit.
Windows Server 2019 77 · 2 crit.
Windows Server 2019 (Server Core installation) 77 · 2 crit.
Windows 11 version 22H2 74 · 2 crit.
Windows 11 version 21H2 74 · 2 crit.
Windows 10 Version 1809 73 · 2 crit.
Windows 10 Version 21H2 72 · 2 crit.
Windows 10 Version 22H2 72 · 2 crit.
Windows Server 2016 69 · 2 crit.
Windows Server 2016 (Server Core installation) 69 · 2 crit.
Windows 10 Version 1607 65 · 2 crit.
Windows 10 Version 1507 62 · 2 crit.

About this page

CVEs published by Microsoft as CVE numbering authority from the day before to two days after its patch day (10 Oct). Exploitation status is updated daily, so a vulnerability can turn red after the release.

All Microsoft vulnerabilities →