Microsoft's security release of 8 August 2023
Patch Tuesday, August 2023
As of , CISA lists one of the 73 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2023-38180, .NET and Visual Studio Denial of Service.
On CISA's list of exploited vulnerabilities
- CVE-2023-38180.NET and Visual Studio Denial of Service. Listed by CISA on 9 August 2023, 1 day after the release
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 73 CVEs |
| On CISA's list of exploited vulnerabilities | 1 CVE |
| CISA's SSVC exploitation: active | 1 CVE |
| CISA's SSVC exploitation: proof of concept | 1 CVE |
| CISA's SSVC exploitation: none | 67 CVEs |
| Not assessed by CISA's SSVC | 4 CVEs |
| Critical by CVSS (9.0 or more) | 4 CVEs |
| EPSS 0.10 or more | 5 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2023-38180.NET and Visual Studio Denial of Service | Active | Patch soonListed | 7.5 High | 0.14 |
| 2 | CVE-2023-36873.NET Framework Spoofing | Proof of concept | Not on CISA's list | 7.4 High | 0.02 |
| 3 | CVE-2023-36899ASP.NET Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.77 |
| 4 | CVE-2023-38181Microsoft Exchange Server Spoofing | None | Not on CISA's list | 8.8 High | 0.11 |
| 5 | CVE-2023-36900Windows Common Log File System Driver Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.11 |
| 6 | CVE-2023-35359Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.10 |
| 7 | CVE-2023-35388Microsoft Exchange Server Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.07 |
| 8 | CVE-2023-38182Microsoft Exchange Server Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.06 |
| 9 | CVE-2023-35382Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.06 |
| 10 | CVE-2023-35386Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.06 |
| 11 | CVE-2023-35380Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.04 |
| 12 | CVE-2023-36910Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.03 |
| 13 | CVE-2023-38185Microsoft Exchange Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.03 |
| 14 | CVE-2023-35383Microsoft Message Queuing Information Disclosure | None | Not on CISA's list | 7.5 High | 0.03 |
| 15 | CVE-2023-38178.NET Core and Visual Studio Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 16 | CVE-2023-21709Microsoft Exchange Server Elevation of Privilege | None | Not on CISA's list | 9.8 Critical | 0.02 |
| 17 | CVE-2023-35385Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.02 |
| 18 | CVE-2023-36911Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.02 |
| 19 | CVE-2023-29328Microsoft Teams Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 20 | CVE-2023-29330Microsoft Teams Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 21 | CVE-2023-35368Microsoft Exchange Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 22 | CVE-2023-35381Windows Fax Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 23 | CVE-2023-36897Visual Studio Tools for Office Runtime Spoofing | None | Not on CISA's list | 8.1 High | 0.02 |
| 24 | CVE-2023-36891Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 8.0 High | 0.02 |
| 25 | CVE-2023-36892Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 8.0 High | 0.02 |
| 26 | CVE-2023-35390.NET and Visual Studio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.02 |
| 27 | CVE-2023-36903Windows System Assessment Tool Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.02 |
| 28 | CVE-2023-36912Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 29 | CVE-2023-38172Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 30 | CVE-2023-35376Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 31 | CVE-2023-35377Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 32 | CVE-2023-36890Microsoft SharePoint Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 33 | CVE-2023-36893Microsoft Outlook Spoofing | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 34 | CVE-2023-36894Microsoft SharePoint Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 35 | CVE-2023-36909Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 36 | CVE-2023-36913Microsoft Message Queuing Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 37 | CVE-2023-38254Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 38 | CVE-2023-35391ASP.NET Core SignalR and Visual Studio Information Disclosure | None | Not on CISA's list | 6.2 Medium | 0.02 |
| 39 | CVE-2023-36905Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.02 |
| 40 | CVE-2023-36906Windows Cryptographic Services Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.02 |
| 41 | CVE-2023-36907Windows Cryptographic Services Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.02 |
| 42 | CVE-2023-35384Windows HTML Platforms Security Feature Bypass | None | Not on CISA's list | 5.4 Medium | 0.02 |
| 43 | CVE-2023-35387Windows Bluetooth A2DP driver Elevation of Privilege | Not assessed | Not on CISA's list | 8.8 High | 0.01 |
| 44 | CVE-2023-36882Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 45 | CVE-2023-38169Microsoft SQL OLE DB Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 46 | CVE-2023-38186Windows Mobile Device Management Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 47 | CVE-2023-35371Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 48 | CVE-2023-35372Microsoft Office Visio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 49 | CVE-2023-35379Reliability Analysis Metrics Calculation Engine (RACEng) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 50 | CVE-2023-36865Microsoft Office Visio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 51 | CVE-2023-36866Microsoft Office Visio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 52 | CVE-2023-36895Microsoft Outlook Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 53 | CVE-2023-36896Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 54 | CVE-2023-36898Tablet Windows User Interface Application Core Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 55 | CVE-2023-36904Windows Cloud Files Mini Filter Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 56 | CVE-2023-38154Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 57 | CVE-2023-38170HEVC Video Extensions Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 58 | CVE-2023-38175Microsoft Windows Defender Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 59 | CVE-2023-38184Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 60 | CVE-2023-38167Microsoft Dynamics 365 Business Central Elevation of Privilege | None | Not on CISA's list | 7.2 High | 0.01 |
| 61 | CVE-2023-36876Reliability Analysis Metrics Calculation (RacTask) Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 62 | CVE-2023-35389Microsoft Dynamics 365 On-Premises Remote Code Execution | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 63 | CVE-2023-36908Windows Hyper-V Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 64 | CVE-2023-36869Azure DevOps Server Spoofing | None | Not on CISA's list | 6.3 Medium | 0.01 |
| 65 | CVE-2023-36889Windows Group Policy Security Feature Bypass | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 66 | CVE-2023-36914Windows Smart Card Resource Management Server Security Feature Bypass | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 67 | CVE-2023-35394Azure HDInsight Jupyter Notebook Spoofing | Not assessed | Not on CISA's list | 4.6 Medium | 0.01 |
| 68 | CVE-2023-35393Azure Apache Hive Spoofing | None | Not on CISA's list | 4.5 Medium | 0.01 |
| 69 | CVE-2023-36877Azure Apache Oozie Spoofing | None | Not on CISA's list | 4.5 Medium | 0.01 |
| 70 | CVE-2023-36881Azure Apache Ambari Spoofing | None | Not on CISA's list | 4.5 Medium | 0.01 |
| 71 | CVE-2023-38188Azure Apache Hadoop Spoofing | None | Not on CISA's list | 4.5 Medium | 0.01 |
| 72 | CVE-2023-35378Windows Projected File System Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 73 | CVE-2023-38176Azure Arc-Enabled Servers Elevation of Privilege | Not assessed | Not on CISA's list | 7.0 High | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 8 August 2023, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.