Microsoft's security release of 12 September 2023
Patch Tuesday, September 2023
As of , CISA lists two of the 59 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2023-36802, Microsoft Streaming Service Proxy Elevation of Privilege.
On CISA's list of exploited vulnerabilities
- CVE-2023-36802Microsoft Streaming Service Proxy Elevation of Privilege. Listed by CISA on 12 September 2023, release day
- CVE-2023-36761Microsoft Word Information Disclosure. Listed by CISA on 12 September 2023, release day
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 59 CVEs |
| On CISA's list of exploited vulnerabilities | 2 CVEs |
| CISA's SSVC exploitation: active | 2 CVEs |
| CISA's SSVC exploitation: proof of concept | 1 CVE |
| CISA's SSVC exploitation: none | 50 CVEs |
| Not assessed by CISA's SSVC | 6 CVEs |
| Critical by CVSS (9.0 or more) | none |
| EPSS 0.10 or more | 10 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2023-36802Microsoft Streaming Service Proxy Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.28 |
| 2 | CVE-2023-36761Microsoft Word Information Disclosure | Active | Patch soonListed | 6.5 Medium | 0.20 |
| 3 | CVE-2023-38150Windows Kernel Elevation of Privilege | Proof of concept | Not on CISA's list | 7.8 High | 0.01 |
| 4 | CVE-2023-36745Microsoft Exchange Server Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.80 |
| 5 | CVE-2023-36744Microsoft Exchange Server Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.57 |
| 6 | CVE-2023-36777Microsoft Exchange Server Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.52 |
| 7 | CVE-2023-36756Microsoft Exchange Server Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.49 |
| 8 | CVE-2023-38146Windows Themes Remote Code Execution | Not assessed | Not on CISA's list | 8.8 High | 0.37 |
| 9 | CVE-2023-36757Microsoft Exchange Server Spoofing | None | Not on CISA's list | 8.0 High | 0.37 |
| 10 | CVE-2023-38152DHCP Server Service Information Disclosure | None | Not on CISA's list | 5.3 Medium | 0.24 |
| 11 | CVE-2023-38162DHCP Server Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.11 |
| 12 | CVE-2023-38148Internet Connection Sharing (ICS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.08 |
| 13 | CVE-2023-38142Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.06 |
| 14 | CVE-2023-36799.NET Core and Visual Studio Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.05 |
| 15 | CVE-2023-38143Windows Common Log File System Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.04 |
| 16 | CVE-2023-38144Windows Common Log File System Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.04 |
| 17 | CVE-2023-38149Windows TCP/IP Denial of Service | None | Not on CISA's list | 7.5 High | 0.04 |
| 18 | CVE-2023-29332Microsoft Azure Kubernetes Service Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.03 |
| 19 | CVE-2023-36767Microsoft Office Security Feature Bypass | None | Not on CISA's list | 4.3 Medium | 0.03 |
| 20 | CVE-2023-33136Azure DevOps Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 21 | CVE-2023-36764Microsoft SharePoint Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.02 |
| 22 | CVE-2023-36763Microsoft Outlook Information Disclosure | None | Not on CISA's list | 7.5 High | 0.02 |
| 23 | CVE-2023-38156Azure HDInsight Apache Ambari JDBC Injection Elevation of Privilege | Not assessed | Not on CISA's list | 7.2 High | 0.02 |
| 24 | CVE-2023-36805Windows MSHTML Platform Security Feature Bypass | None | Not on CISA's list | 7.0 High | 0.02 |
| 25 | CVE-2023-36801DHCP Server Service Information Disclosure | None | Not on CISA's list | 5.3 Medium | 0.02 |
| 26 | CVE-2023-38147Windows Miracast Wireless Display Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 27 | CVE-2023-35355Windows Cloud Files Mini Filter Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 28 | CVE-2023-367393D Viewer Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 29 | CVE-2023-367403D Viewer Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 30 | CVE-2023-36742Visual Studio Code Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 31 | CVE-2023-36758Visual Studio Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.01 |
| 32 | CVE-2023-367603D Viewer Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 33 | CVE-2023-36765Microsoft Office Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 34 | CVE-2023-36766Microsoft Excel Information Disclosure | None | Not on CISA's list | 7.8 High | 0.01 |
| 35 | CVE-2023-367703D Builder Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 36 | CVE-2023-367713D Builder Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 37 | CVE-2023-367723D Builder Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 38 | CVE-2023-367733D Builder Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 39 | CVE-2023-36788.NET Framework Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 40 | CVE-2023-36792Visual Studio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 41 | CVE-2023-36793Visual Studio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 42 | CVE-2023-36794Visual Studio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 43 | CVE-2023-36796Visual Studio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 44 | CVE-2023-36804Windows GDI Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 45 | CVE-2023-38139Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 46 | CVE-2023-38141Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 47 | CVE-2023-38161Windows GDI Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 48 | CVE-2023-38163Windows Defender Attack Surface Reduction Security Feature Bypass | None | Not on CISA's list | 7.8 High | 0.01 |
| 49 | CVE-2023-36800Dynamics Finance and Operations Cross-site Scripting | None | Not on CISA's list | 7.6 High | 0.01 |
| 50 | CVE-2023-36886Microsoft Dynamics 365 (on-premises) Cross-site Scripting | None | Not on CISA's list | 7.6 High | 0.01 |
| 51 | CVE-2023-38164Microsoft Dynamics 365 (on-premises) Cross-site Scripting | None | Not on CISA's list | 7.6 High | 0.01 |
| 52 | CVE-2023-36762Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 53 | CVE-2023-38155Azure DevOps Server Remote Code Execution | Not assessed | Not on CISA's list | 7.0 High | 0.01 |
| 54 | CVE-2023-36759Visual Studio Elevation of Privilege | Not assessed | Not on CISA's list | 6.7 Medium | 0.01 |
| 55 | CVE-2023-36803Windows Kernel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 56 | CVE-2023-38140Windows Kernel Information Disclosure | Not assessed | Not on CISA's list | 5.5 Medium | 0.01 |
| 57 | CVE-2023-38160Windows TCP/IP Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 58 | CVE-2023-41764Microsoft Office Spoofing | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 59 | CVE-2023-36736Microsoft Identity Linux Broker Remote Code Execution | None | Not on CISA's list | 4.4 Medium | 0.01 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 12 September 2023, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.