Microsoft Patch Tuesday — December 2023

Tuesday, 12 December 2023

Vulnerabilities: 34
Critical: 1
High: 23
Zero-days: 0
Public exploit: 2

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 1

Critical 9.6
CVE-2023-36019 Microsoft Power Platform Connector Spoofing Vulnerability
EPSS 16%

Public exploit code 2

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

Medium 6.7
CVE-2023-36003 Public exploit XAML Diagnostics Elevation of Privilege Vulnerability
EPSS 2.8%
Medium 6.5
CVE-2023-35636 Public exploit Microsoft Outlook Information Disclosure Vulnerability
EPSS 18%

All vulnerabilities 34

Critical1 Show

Critical 9.6
CVE-2023-36019 Microsoft Power Platform Connector Spoofing Vulnerability
EPSS 16%

High23 Show

High 8.8
CVE-2023-35630 Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
EPSS 6.1%
High 8.8
CVE-2023-35639 Microsoft ODBC Driver Remote Code Execution Vulnerability
EPSS 2.4%
High 8.8
CVE-2023-35641 Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
EPSS 7.2%
High 8.8
CVE-2023-36006 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 1.9%
High 8.1
CVE-2023-35628 Windows MSHTML Platform Remote Code Execution Vulnerability
EPSS 93%
High 8.0
CVE-2023-35634 Windows Bluetooth Driver Remote Code Execution Vulnerability
High 7.8
CVE-2023-21740 Windows Media Remote Code Execution Vulnerability
EPSS 1.1%
High 7.8
CVE-2023-35631 Win32k Elevation of Privilege Vulnerability
EPSS 6.5%
High 7.8
CVE-2023-35632 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
EPSS 6.5%
High 7.8
CVE-2023-35633 Windows Kernel Elevation of Privilege Vulnerability
EPSS 8.7%
High 7.8
CVE-2023-35644 Windows Sysmain Service Elevation of Privilege Vulnerability
EPSS 6.3%
High 7.8
CVE-2023-36011 Win32k Elevation of Privilege Vulnerability
High 7.8
CVE-2023-36391 Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
EPSS 7.2%
High 7.8
CVE-2023-36696 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
High 7.6
CVE-2023-36020 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
High 7.5
CVE-2023-35621 Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability
EPSS 2.3%
High 7.5
CVE-2023-35622 Windows DNS Spoofing Vulnerability
EPSS 1.6%
High 7.5
CVE-2023-35638 DHCP Server Service Denial of Service Vulnerability
EPSS 3.3%
High 7.5
CVE-2023-35643 DHCP Server Service Information Disclosure Vulnerability
EPSS 2.6%
High 7.5
CVE-2023-36004 Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability
EPSS 1.4%
High 7.5
CVE-2023-36005 Windows Telephony Server Elevation of Privilege Vulnerability
EPSS 24%
High 7.5
CVE-2023-36010 Microsoft Defender Denial of Service Vulnerability
EPSS 2.7%
High 7.3
CVE-2023-35624 Azure Connected Machine Agent Elevation of Privilege Vulnerability

Medium10 Show

Medium 6.8
CVE-2023-35629 Microsoft USBHUB 3.0 Device Driver Remote Code Execution Vulnerability
Medium 6.7
CVE-2023-36003 Public exploit XAML Diagnostics Elevation of Privilege Vulnerability
EPSS 2.8%
Medium 6.5
CVE-2023-35636 Public exploit Microsoft Outlook Information Disclosure Vulnerability
EPSS 18%
Medium 6.5
CVE-2023-21751 Azure DevOps Server Spoofing Vulnerability
Medium 6.5
CVE-2023-35642 Internet Connection Sharing (ICS) Denial of Service Vulnerability
EPSS 1.3%
Medium 5.5
CVE-2023-35635 Windows Kernel Denial of Service Vulnerability
Medium 5.5
CVE-2023-36009 Microsoft Word Information Disclosure Vulnerability
EPSS 1.2%
Medium 5.3
CVE-2023-35619 Microsoft Outlook for Mac Spoofing Vulnerability
EPSS 1.2%
Medium 5.3
CVE-2023-36012 DHCP Server Service Information Disclosure Vulnerability
EPSS 2%
Medium 4.7
CVE-2023-35625 Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability