Microsoft's security release of 10 October 2023
Patch Tuesday, October 2023
As of , CISA lists three of the 103 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2023-41763, Skype for Business Elevation of Privilege.
On CISA's list of exploited vulnerabilities
- CVE-2023-41763Skype for Business Elevation of Privilege. Listed by CISA on 10 October 2023, release day
- CVE-2023-36563Microsoft WordPad Information Disclosure. Listed by CISA on 10 October 2023, release day
- CVE-2023-36584Windows Mark of the Web Security Feature Bypass. Listed by CISA on 16 November 2023, 37 days after the release
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 103 CVEs |
| On CISA's list of exploited vulnerabilities | 3 CVEs |
| CISA's SSVC exploitation: active | 3 CVEs |
| CISA's SSVC exploitation: proof of concept | none |
| CISA's SSVC exploitation: none | 79 CVEs |
| Not assessed by CISA's SSVC | 21 CVEs |
| Critical by CVSS (9.0 or more) | 2 CVEs |
| EPSS 0.10 or more | 5 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2023-41763Skype for Business Elevation of Privilege | Active | Patch this weekListed | 5.3 Medium | 0.91 |
| 2 | CVE-2023-36563Microsoft WordPad Information Disclosure | Active | Patch soonListed | 6.5 Medium | 0.21 |
| 3 | CVE-2023-36584Windows Mark of the Web Security Feature Bypass | Active | Patch soonListed | 5.4 Medium | 0.03 |
| 4 | CVE-2023-38171Microsoft QUIC Denial of Service | None | Not on CISA's list | 7.5 High | 0.71 |
| 5 | CVE-2023-36606Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 7.5 High | 0.69 |
| 6 | CVE-2023-41772Win32k Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.13 |
| 7 | CVE-2023-36594Windows Graphics Component Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.09 |
| 8 | CVE-2023-36731Win32k Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.07 |
| 9 | CVE-2023-36713Windows Common Log File System Driver Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.07 |
| 10 | CVE-2023-36435Microsoft QUIC Denial of Service | None | Not on CISA's list | 7.5 High | 0.06 |
| 11 | CVE-2023-36743Win32k Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.04 |
| 12 | CVE-2023-38159Windows Graphics Component Elevation of Privilege | Not assessed | Not on CISA's list | 7.0 High | 0.04 |
| 13 | CVE-2023-35349Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.03 |
| 14 | CVE-2023-36585Windows upnphost.dll Denial of Service | Not assessed | Not on CISA's list | 7.5 High | 0.03 |
| 15 | CVE-2023-36703DHCP Server Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 16 | CVE-2023-36709Microsoft AllJoyn API Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 17 | CVE-2023-36720Windows Mixed Reality Developer Tools Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 18 | CVE-2023-36780Skype for Business Remote Code Execution | None | Not on CISA's list | 7.2 High | 0.03 |
| 19 | CVE-2023-36786Skype for Business Remote Code Execution | None | Not on CISA's list | 7.2 High | 0.03 |
| 20 | CVE-2023-36789Skype for Business Remote Code Execution | None | Not on CISA's list | 7.2 High | 0.03 |
| 21 | CVE-2023-36566Microsoft Common Data Model SDK Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.03 |
| 22 | CVE-2023-36707Windows Deployment Services Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.03 |
| 23 | CVE-2023-36434Windows IIS Server Elevation of Privilege | Not assessed | Not on CISA's list | 9.8 Critical | 0.02 |
| 24 | CVE-2023-36414Azure Identity SDK Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 25 | CVE-2023-36415Azure Identity SDK Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 26 | CVE-2023-36419Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.02 |
| 27 | CVE-2023-36577Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 28 | CVE-2023-36778Microsoft Exchange Server Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.02 |
| 29 | CVE-2023-36723Windows Container Manager Service Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.02 |
| 30 | CVE-2023-29348Windows Remote Desktop Gateway (RD Gateway) Information Disclosure | None | Not on CISA's list | 7.5 High | 0.02 |
| 31 | CVE-2023-36431Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 32 | CVE-2023-36438Windows TCP/IP Information Disclosure | None | Not on CISA's list | 7.5 High | 0.02 |
| 33 | CVE-2023-36567Windows Deployment Services Information Disclosure | None | Not on CISA's list | 7.5 High | 0.02 |
| 34 | CVE-2023-36579Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 35 | CVE-2023-36581Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 36 | CVE-2023-36596Remote Procedure Call Information Disclosure | None | Not on CISA's list | 7.5 High | 0.02 |
| 37 | CVE-2023-36602Windows TCP/IP Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 38 | CVE-2023-36603Windows TCP/IP Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 39 | CVE-2023-36776Win32k Elevation of Privilege | Not assessed | Not on CISA's list | 7.0 High | 0.02 |
| 40 | CVE-2023-36697Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 6.8 Medium | 0.02 |
| 41 | CVE-2023-36429Microsoft Dynamics 365 (On-Premises) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 42 | CVE-2023-36433Microsoft Dynamics 365 (On-Premises) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 43 | CVE-2023-36706Windows Deployment Services Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 44 | CVE-2023-36569Microsoft Office Elevation of Privilege | None | Not on CISA's list | 8.4 High | 0.01 |
| 45 | CVE-2023-38166Layer 2 Tunneling Protocol Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 46 | CVE-2023-41765Layer 2 Tunneling Protocol Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 47 | CVE-2023-41767Layer 2 Tunneling Protocol Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 48 | CVE-2023-41768Layer 2 Tunneling Protocol Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 49 | CVE-2023-41769Layer 2 Tunneling Protocol Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 50 | CVE-2023-41770Layer 2 Tunneling Protocol Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 51 | CVE-2023-41771Layer 2 Tunneling Protocol Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 52 | CVE-2023-41773Layer 2 Tunneling Protocol Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 53 | CVE-2023-41774Layer 2 Tunneling Protocol Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 54 | CVE-2023-36417Microsoft SQL OLE DB Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 55 | CVE-2023-36418Azure RTOS GUIX Studio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 56 | CVE-2023-36420Microsoft ODBC Driver for SQL Server Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 57 | CVE-2023-36436Windows MSHTML Platform Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 58 | CVE-2023-36557PrintHTML API Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 59 | CVE-2023-36593Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 60 | CVE-2023-36598Microsoft WDAC ODBC Driver Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 61 | CVE-2023-36701Microsoft Resilient File System (ReFS) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 62 | CVE-2023-36702Microsoft DirectMusic Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 63 | CVE-2023-36704Windows Setup Files Cleanup Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 64 | CVE-2023-36710Windows Media Foundation Core Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 65 | CVE-2023-36711Windows Runtime C++ Template Library Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.01 |
| 66 | CVE-2023-36712Windows Kernel Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.01 |
| 67 | CVE-2023-36718Microsoft Virtual Trusted Platform Module Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 68 | CVE-2023-36725Windows Kernel Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.01 |
| 69 | CVE-2023-36726Windows Internet Key Exchange (IKE) Extension Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.01 |
| 70 | CVE-2023-36729Named Pipe File System Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.01 |
| 71 | CVE-2023-36730Microsoft ODBC Driver for SQL Server Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 72 | CVE-2023-36732Win32k Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.01 |
| 73 | CVE-2023-36737Azure Network Watcher VM Agent Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.01 |
| 74 | CVE-2023-36785Microsoft ODBC Driver for SQL Server Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 75 | CVE-2023-36790Windows RDP Encoder Mirror Driver Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.01 |
| 76 | CVE-2023-41766Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.01 |
| 77 | CVE-2023-36561Azure DevOps Server Elevation of Privilege | Not assessed | Not on CISA's list | 7.3 High | 0.01 |
| 78 | CVE-2023-36570Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 79 | CVE-2023-36571Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 80 | CVE-2023-36572Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 81 | CVE-2023-36573Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 82 | CVE-2023-36574Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 83 | CVE-2023-36575Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 84 | CVE-2023-36578Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 85 | CVE-2023-36582Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 86 | CVE-2023-36583Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 87 | CVE-2023-36589Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 88 | CVE-2023-36590Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 89 | CVE-2023-36591Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 90 | CVE-2023-36592Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 91 | CVE-2023-36902Windows Runtime Remote Code Execution | None | Not on CISA's list | 7.0 High | 0.01 |
| 92 | CVE-2023-36564Windows Search Security Feature Bypass | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 93 | CVE-2023-36717Windows Virtual Trusted Platform Module Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 94 | CVE-2023-36416Microsoft Dynamics 365 (on-premises) Cross-site Scripting | None | Not on CISA's list | 6.1 Medium | 0.01 |
| 95 | CVE-2023-36576Windows Kernel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 96 | CVE-2023-36724Windows Power Management Service Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 97 | CVE-2023-36728Microsoft SQL Server Denial of Service | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 98 | CVE-2023-36722Active Directory Domain Services Information Disclosure | None | Not on CISA's list | 4.4 Medium | 0.01 |
| 99 | CVE-2023-36605Windows Named Pipe Filesystem Elevation of Privilege | Not assessed | Not on CISA's list | 7.4 High | 0.00 |
| 100 | CVE-2023-36565Microsoft Office Graphics Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 10 October 2023, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.