Microsoft Patch Tuesday — November 2023

Tuesday, 14 November 2023

Vulnerabilities: 59
Critical: 2
High: 44
Zero-days: 3
Public exploit: 4

Exploited 4

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

High 8.8
CVE-2023-36025 Zero-day Public exploit Windows SmartScreen Security Feature Bypass Vulnerability
EPSS 88%
High 7.8
CVE-2023-36424 Exploited Public exploit Windows Common Log File System Driver Elevation of Privilege Vulnerability
EPSS 12%
High 7.8
CVE-2023-36033 Zero-day Windows DWM Core Library Elevation of Privilege Vulnerability
EPSS 11%
High 7.8
CVE-2023-36036 Zero-day Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
EPSS 17%

Critical 2

Critical 9.8
CVE-2023-36028 Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
EPSS 2.8%
Critical 9.8
CVE-2023-36397 Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
EPSS 18%

Public exploit code 2

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

High 7.8
CVE-2023-36407 Public exploit Windows Hyper-V Elevation of Privilege Vulnerability
EPSS 1.7%
High 7.0
CVE-2023-36427 Public exploit Windows Hyper-V Elevation of Privilege Vulnerability
EPSS 1.5%

All vulnerabilities 59

Critical2 Show

Critical 9.8
CVE-2023-36028 Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
EPSS 2.8%
Critical 9.8
CVE-2023-36397 Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
EPSS 18%

High44 Show

High 8.8
CVE-2023-36025 Zero-day Public exploit Windows SmartScreen Security Feature Bypass Vulnerability
EPSS 88%
High 7.8
CVE-2023-36424 Exploited Public exploit Windows Common Log File System Driver Elevation of Privilege Vulnerability
EPSS 12%
High 7.8
CVE-2023-36033 Zero-day Windows DWM Core Library Elevation of Privilege Vulnerability
EPSS 11%
High 7.8
CVE-2023-36036 Zero-day Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
EPSS 17%
High 8.8
CVE-2023-36017 Windows Scripting Engine Memory Corruption Vulnerability
EPSS 25%
High 8.8
CVE-2023-36400 Windows HMAC Key Derivation Elevation of Privilege Vulnerability
EPSS 4.3%
High 8.8
CVE-2023-36402 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 1.8%
High 8.8
CVE-2023-36423 Microsoft Remote Registry Service Remote Code Execution Vulnerability
EPSS 2%
High 8.8
CVE-2023-36437 Azure DevOps Server Remote Code Execution Vulnerability
EPSS 2%
High 8.8
CVE-2023-36560 ASP.NET Security Feature Bypass Vulnerability
EPSS 2.9%
High 8.8
CVE-2023-38151 Microsoft Host Integration Server 2020 Remote Code Execution Vulnerability
EPSS 1.8%
High 8.6
CVE-2023-36052 Azure CLI REST Command Information Disclosure Vulnerability
EPSS 21%
High 8.2
CVE-2023-36038 ASP.NET Core Denial of Service Vulnerability
EPSS 2.8%
High 8.0
CVE-2023-36021 Microsoft On-Prem Data Gateway Security Feature Bypass Vulnerability
EPSS 1.7%
High 8.0
CVE-2023-36035 Microsoft Exchange Server Spoofing Vulnerability
EPSS 87%
High 8.0
CVE-2023-36039 Microsoft Exchange Server Spoofing Vulnerability
EPSS 73%
High 8.0
CVE-2023-36050 Microsoft Exchange Server Spoofing Vulnerability
EPSS 39%
High 8.0
CVE-2023-36425 Windows Distributed File System (DFS) Remote Code Execution Vulnerability
EPSS 1.5%
High 8.0
CVE-2023-36439 Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 5%
High 7.8
CVE-2023-36407 Public exploit Windows Hyper-V Elevation of Privilege Vulnerability
EPSS 1.7%
High 7.8
CVE-2023-36018 Visual Studio Code Jupyter Extension Spoofing Vulnerability
EPSS 1.5%
High 7.8
CVE-2023-36037 Microsoft Excel Security Feature Bypass Vulnerability
EPSS 1.2%
High 7.8
CVE-2023-36041 Microsoft Excel Remote Code Execution Vulnerability
EPSS 57%
High 7.8
CVE-2023-36045 Microsoft Office Graphics Remote Code Execution Vulnerability
High 7.8
CVE-2023-36047 Windows Authentication Elevation of Privilege Vulnerability
EPSS 1.1%
High 7.8
CVE-2023-36393 Windows User Interface Application Core Remote Code Execution Vulnerability
High 7.8
CVE-2023-36396 Windows Compressed Folder Remote Code Execution Vulnerability
EPSS 1.7%
High 7.8
CVE-2023-36408 Windows Hyper-V Elevation of Privilege Vulnerability
High 7.8
CVE-2023-36422 Microsoft Windows Defender Elevation of Privilege Vulnerability
High 7.8
CVE-2023-36705 Windows Installer Elevation of Privilege Vulnerability
High 7.8
CVE-2023-36719 Microsoft Speech Application Programming Interface (SAPI) Elevation of Privilege Vulnerability
High 7.6
CVE-2023-36007 Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability
EPSS 1.1%
High 7.6
CVE-2023-36031 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
High 7.6
CVE-2023-36049 .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
EPSS 6.8%
High 7.6
CVE-2023-36410 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
High 7.5
CVE-2023-36392 DHCP Server Service Denial of Service Vulnerability
EPSS 2.5%
High 7.5
CVE-2023-36395 Windows Deployment Services Denial of Service Vulnerability
EPSS 2.5%
High 7.2
CVE-2023-36401 Microsoft Remote Registry Service Remote Code Execution Vulnerability
EPSS 1.9%
High 7.1
CVE-2023-36046 Windows Authentication Denial of Service Vulnerability
High 7.1
CVE-2023-36399 Windows Storage Elevation of Privilege Vulnerability
EPSS 8.3%
High 7.0
CVE-2023-36427 Public exploit Windows Hyper-V Elevation of Privilege Vulnerability
EPSS 1.5%
High 7.0
CVE-2023-36394 Windows Search Service Elevation of Privilege Vulnerability
EPSS 6.7%
High 7.0
CVE-2023-36403 Windows Kernel Elevation of Privilege Vulnerability
High 7.0
CVE-2023-36405 Windows Kernel Elevation of Privilege Vulnerability

Medium13 Show

Medium 6.6
CVE-2023-36008 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Medium 6.5
CVE-2023-36043 Open Management Infrastructure Information Disclosure Vulnerability
EPSS 1.4%
Medium 6.5
CVE-2023-36398 Windows NTFS Information Disclosure Vulnerability
Medium 6.5
CVE-2023-36413 Microsoft Office Security Feature Bypass Vulnerability
EPSS 30%
Medium 6.2
CVE-2023-36016 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
EPSS 1.3%
Medium 6.2
CVE-2023-36042 Visual Studio Denial of Service Vulnerability
Medium 6.2
CVE-2023-36558 ASP.NET Core Security Feature Bypass Vulnerability
EPSS 1.1%
Medium 6.1
CVE-2023-36030 Microsoft Dynamics 365 Sales Spoofing Vulnerability
Medium 6.1
CVE-2023-38177 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 3.4%
Medium 5.5
CVE-2023-36404 Windows Kernel Information Disclosure Vulnerability
Medium 5.5
CVE-2023-36406 Windows Hyper-V Information Disclosure Vulnerability
Medium 5.5
CVE-2023-36428 Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
Medium 4.3
CVE-2023-36026 Microsoft Edge (Chromium-based) Spoofing Vulnerability

Most affected products

Windows Server 2022 29 · 2 crit.
Windows Server 2022, 23H2 Edition (Server Core installation) 29 · 2 crit.
Windows 11 version 23H2 28 · 2 crit.
Windows 11 version 22H2 28 · 2 crit.
Windows 11 version 21H2 28 · 2 crit.
Windows 11 version 22H3 27 · 2 crit.
Windows Server 2019 26 · 2 crit.
Windows Server 2019 (Server Core installation) 26 · 2 crit.
Windows 10 Version 1809 24 · 2 crit.
Windows 10 Version 21H2 24 · 2 crit.
Windows 10 Version 22H2 24 · 2 crit.
Windows Server 2016 23 · 2 crit.

About this page

CVEs published by Microsoft as CVE numbering authority from the day before to two days after its patch day (14 Nov). Exploitation status is updated daily, so a vulnerability can turn red after the release.

All Microsoft vulnerabilities →