Microsoft's security release of 9 May 2023
Patch Tuesday, May 2023
As of , CISA lists two of the 36 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2023-24955, Microsoft SharePoint Server Remote Code Execution.
On CISA's list of exploited vulnerabilities
- CVE-2023-24955Microsoft SharePoint Server Remote Code Execution. Listed by CISA on 26 March 2024, 322 days after the release
- CVE-2023-29336Win32k Elevation of Privilege. Listed by CISA on 9 May 2023, release day
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 36 CVEs |
| On CISA's list of exploited vulnerabilities | 2 CVEs |
| CISA's SSVC exploitation: active | 3 CVEs |
| CISA's SSVC exploitation: proof of concept | 1 CVE |
| CISA's SSVC exploitation: none | 21 CVEs |
| Not assessed by CISA's SSVC | 11 CVEs |
| Critical by CVSS (9.0 or more) | 2 CVEs |
| EPSS 0.10 or more | 7 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2023-24955Microsoft SharePoint Server Remote Code Execution | Active | Patch this weekListed | 7.2 High | 0.85 |
| 2 | CVE-2023-29336Win32k Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.41 |
| 3 | CVE-2023-24932Secure Boot Security Feature Bypass | Active | Not on CISA's list | 6.7 Medium | 0.11 |
| 4 | CVE-2023-29338Visual Studio Code Spoofing | Proof of concept | Not on CISA's list | 6.6 Medium | 0.01 |
| 5 | CVE-2023-24941Windows Network File System Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.95 |
| 6 | CVE-2023-29325Windows OLE Remote Code Execution | Not assessed | Not on CISA's list | 8.1 High | 0.84 |
| 7 | CVE-2023-24950Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 6.5 Medium | 0.67 |
| 8 | CVE-2023-24949Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.25 |
| 9 | CVE-2023-24943Windows Pragmatic General Multicast (PGM) Remote Code Execution | Not assessed | Not on CISA's list | 9.8 Critical | 0.05 |
| 10 | CVE-2023-24902Win32k Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.05 |
| 11 | CVE-2023-24939Server for NFS Denial of Service | None | Not on CISA's list | 7.5 High | 0.05 |
| 12 | CVE-2023-24940Windows Pragmatic General Multicast (PGM) Denial of Service | None | Not on CISA's list | 7.5 High | 0.05 |
| 13 | CVE-2023-29324Windows MSHTML Platform Security Feature Bypass | Not assessed | Not on CISA's list | 6.5 Medium | 0.03 |
| 14 | CVE-2023-29343SysInternals Sysmon for Windows Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.02 |
| 15 | CVE-2023-24898Windows SMB Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 16 | CVE-2023-24901Windows NFS Portmapper Information Disclosure | Not assessed | Not on CISA's list | 7.5 High | 0.02 |
| 17 | CVE-2023-24942Remote Procedure Call Runtime Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 18 | CVE-2023-24954Microsoft SharePoint Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 19 | CVE-2023-24947Windows Bluetooth Driver Remote Code Execution | Not assessed | Not on CISA's list | 8.8 High | 0.01 |
| 20 | CVE-2023-24903Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution | Not assessed | Not on CISA's list | 8.1 High | 0.01 |
| 21 | CVE-2023-28283Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution | Not assessed | Not on CISA's list | 8.1 High | 0.01 |
| 22 | CVE-2023-24905Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 23 | CVE-2023-24953Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 24 | CVE-2023-29340AV1 Video Extension Remote Code Execution | Not assessed | Not on CISA's list | 7.8 High | 0.01 |
| 25 | CVE-2023-29341AV1 Video Extension Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 26 | CVE-2023-29335Microsoft Word Security Feature Bypass | None | Not on CISA's list | 7.5 High | 0.01 |
| 27 | CVE-2023-24948Windows Bluetooth Driver Elevation of Privilege | None | Not on CISA's list | 7.4 High | 0.01 |
| 28 | CVE-2023-24904Windows Installer Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 29 | CVE-2023-24944Windows Bluetooth Driver Information Disclosure | Not assessed | Not on CISA's list | 6.5 Medium | 0.01 |
| 30 | CVE-2023-24900Windows NTLM Security Support Provider Information Disclosure | None | Not on CISA's list | 5.9 Medium | 0.01 |
| 31 | CVE-2023-24945Windows iSCSI Target Service Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 32 | CVE-2023-28290Microsoft Remote Desktop app for Windows Information Disclosure | Not assessed | Not on CISA's list | 5.3 Medium | 0.01 |
| 33 | CVE-2023-29333Microsoft Access Denial of Service | None | Not on CISA's list | 3.3 Low | 0.01 |
| 34 | CVE-2023-24946Windows Backup Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 35 | CVE-2023-24899Windows Graphics Component Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 36 | CVE-2023-28251Windows Driver Revocation List Security Feature Bypass | None | Not on CISA's list | 5.5 Medium | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 9 May 2023, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.