Microsoft's security release of 11 April 2023
Patch Tuesday, April 2023
As of , CISA lists two of the 98 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2023-28252, Windows Common Log File System Driver Elevation of Privilege.
On CISA's list of exploited vulnerabilities
- CVE-2023-28252Windows Common Log File System Driver Elevation of Privilege. Listed by CISA on 11 April 2023, release day
- CVE-2023-28229Windows CNG Key Isolation Service Elevation of Privilege. Listed by CISA on 4 October 2023, 176 days after the release
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 98 CVEs |
| On CISA's list of exploited vulnerabilities | 2 CVEs |
| CISA's SSVC exploitation: active | 2 CVEs |
| CISA's SSVC exploitation: proof of concept | none |
| CISA's SSVC exploitation: none | 91 CVEs |
| Not assessed by CISA's SSVC | 5 CVEs |
| Critical by CVSS (9.0 or more) | 2 CVEs |
| EPSS 0.10 or more | 8 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2023-28252Windows Common Log File System Driver Elevation of Privilege | Active | Patch this weekListed | 7.8 High | 0.49 |
| 2 | CVE-2023-28229Windows CNG Key Isolation Service Elevation of Privilege | Active | Patch soonListed | 7.0 High | 0.02 |
| 3 | CVE-2023-21554Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.95 |
| 4 | CVE-2023-28302Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 7.5 High | 0.93 |
| 5 | CVE-2023-21769Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 7.5 High | 0.89 |
| 6 | CVE-2023-28231DHCP Server Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.37 |
| 7 | CVE-2023-28219Layer 2 Tunneling Protocol Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.15 |
| 8 | CVE-2023-28220Layer 2 Tunneling Protocol Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.15 |
| 9 | CVE-2023-28218Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.12 |
| 10 | CVE-2023-28274Windows Win32k Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.07 |
| 11 | CVE-2023-28227Windows Bluetooth Driver Remote Code Execution | Not assessed | Not on CISA's list | 7.5 High | 0.07 |
| 12 | CVE-2023-28288Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 8.1 High | 0.06 |
| 13 | CVE-2023-24912Windows Graphics Component Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.04 |
| 14 | CVE-2023-28266Windows Common Log File System Driver Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.04 |
| 15 | CVE-2023-28244Windows Kerberos Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.03 |
| 16 | CVE-2023-28285Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.03 |
| 17 | CVE-2023-28293Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.03 |
| 18 | CVE-2023-28311Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.03 |
| 19 | CVE-2023-24860Microsoft Defender Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 20 | CVE-2023-28250Windows Pragmatic General Multicast (PGM) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.02 |
| 21 | CVE-2023-21727Remote Procedure Call Runtime Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 22 | CVE-2023-24884Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 23 | CVE-2023-24885Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 24 | CVE-2023-24886Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 25 | CVE-2023-24887Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 26 | CVE-2023-24924Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 27 | CVE-2023-24925Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 28 | CVE-2023-24926Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 29 | CVE-2023-24927Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 30 | CVE-2023-24928Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 31 | CVE-2023-24929Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 32 | CVE-2023-28243Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 33 | CVE-2023-28297Windows Remote Procedure Call Service (RPCSS) Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.02 |
| 34 | CVE-2023-28260.NET DLL Hijacking Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.02 |
| 35 | CVE-2023-24931Windows Secure Channel Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 36 | CVE-2023-28217Windows Network Address Translation (NAT) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 37 | CVE-2023-28233Windows Secure Channel Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 38 | CVE-2023-28234Windows Secure Channel Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 39 | CVE-2023-28241Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 40 | CVE-2023-28247Windows Network File System Information Disclosure | None | Not on CISA's list | 7.5 High | 0.02 |
| 41 | CVE-2023-28267Remote Desktop Protocol Client Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 42 | CVE-2023-28312Azure Machine Learning Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 43 | CVE-2023-28240Windows Network Load Balancing Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 44 | CVE-2023-28275Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 45 | CVE-2023-28291Raw Image Extension Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 46 | CVE-2023-28268Netlogon RPC Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.01 |
| 47 | CVE-2023-23375Microsoft ODBC and OLE DB Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 48 | CVE-2023-24893Visual Studio Code Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 49 | CVE-2023-28237Windows Kernel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 50 | CVE-2023-28248Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 51 | CVE-2023-28292Raw Image Extension Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 52 | CVE-2023-28296Visual Studio Remote Code Execution | Not assessed | Not on CISA's list | 7.8 High | 0.01 |
| 53 | CVE-2023-28304Microsoft ODBC and OLE DB Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 54 | CVE-2023-28309Microsoft Dynamics 365 (on-premises) Cross-site Scripting | None | Not on CISA's list | 7.6 High | 0.01 |
| 55 | CVE-2023-28232Windows Point-to-Point Tunneling Protocol Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 56 | CVE-2023-28238Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 57 | CVE-2023-28300Azure Service Connector Security Feature Bypass | None | Not on CISA's list | 7.5 High | 0.01 |
| 58 | CVE-2023-23384Microsoft SQL Server Remote Code Execution | Not assessed | Not on CISA's list | 7.3 High | 0.01 |
| 59 | CVE-2023-28254Windows DNS Server Remote Code Execution | None | Not on CISA's list | 7.2 High | 0.01 |
| 60 | CVE-2023-28222Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 61 | CVE-2023-28235Windows Lock Screen Security Feature Bypass | Not assessed | Not on CISA's list | 6.8 Medium | 0.01 |
| 62 | CVE-2023-28223Windows Domain Name Service Remote Code Execution | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 63 | CVE-2023-28255Windows DNS Server Remote Code Execution | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 64 | CVE-2023-28256Windows DNS Server Remote Code Execution | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 65 | CVE-2023-28278Windows DNS Server Remote Code Execution | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 66 | CVE-2023-28305Windows DNS Server Remote Code Execution | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 67 | CVE-2023-28306Windows DNS Server Remote Code Execution | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 68 | CVE-2023-28307Windows DNS Server Remote Code Execution | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 69 | CVE-2023-28308Windows DNS Server Remote Code Execution | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 70 | CVE-2023-24883Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 71 | CVE-2023-28249Windows Boot Manager Security Feature Bypass | None | Not on CISA's list | 6.2 Medium | 0.01 |
| 72 | CVE-2023-28269Windows Boot Manager Security Feature Bypass | None | Not on CISA's list | 6.2 Medium | 0.01 |
| 73 | CVE-2023-24935Microsoft Edge (Chromium-based) Spoofing | None | Not on CISA's list | 6.1 Medium | 0.01 |
| 74 | CVE-2023-28313Microsoft Dynamics 365 Customer Voice Cross-Site Scripting | None | Not on CISA's list | 6.1 Medium | 0.01 |
| 75 | CVE-2023-28314Microsoft Dynamics 365 (on-premises) Cross-site Scripting | None | Not on CISA's list | 6.1 Medium | 0.01 |
| 76 | CVE-2023-28253Windows Kernel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 77 | CVE-2023-28263Visual Studio Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 78 | CVE-2023-28271Windows Kernel Memory Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 79 | CVE-2023-28298Windows Kernel Denial of Service | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 80 | CVE-2023-28299Visual Studio Spoofing | Not assessed | Not on CISA's list | 5.5 Medium | 0.01 |
| 81 | CVE-2023-28226Windows Enroll Engine Security Feature Bypass | None | Not on CISA's list | 5.3 Medium | 0.01 |
| 82 | CVE-2023-28277Windows DNS Server Information Disclosure | None | Not on CISA's list | 4.9 Medium | 0.01 |
| 83 | CVE-2023-21729Remote Procedure Call Runtime Information Disclosure | None | Not on CISA's list | 4.3 Medium | 0.01 |
| 84 | CVE-2023-28284Microsoft Edge (Chromium-based) Security Feature Bypass | None | Not on CISA's list | 4.3 Medium | 0.01 |
| 85 | CVE-2023-28301Microsoft Edge (Chromium-based) Tampering | None | Not on CISA's list | 3.7 Low | 0.01 |
| 86 | CVE-2023-28225Windows NTLM Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 87 | CVE-2023-28236Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 88 | CVE-2023-28246Windows Registry Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 89 | CVE-2023-28262Visual Studio Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 90 | CVE-2023-28272Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 91 | CVE-2023-28224Windows Point-to-Point Protocol over Ethernet (PPPoE) Remote Code Execution | None | Not on CISA's list | 7.1 High | 0.00 |
| 92 | CVE-2023-24914Win32k Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 93 | CVE-2023-28216Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 94 | CVE-2023-28221Windows Error Reporting Service Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 95 | CVE-2023-28273Windows Clip Service Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 96 | CVE-2023-28270Windows Lock Screen Security Feature Bypass | None | Not on CISA's list | 6.8 Medium | 0.00 |
| 97 | CVE-2023-28228Windows Spoofing | None | Not on CISA's list | 5.5 Medium | 0.00 |
| 98 | CVE-2023-28276Windows Group Policy Security Feature Bypass | None | Not on CISA's list | 4.4 Medium | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 11 April 2023, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.