Microsoft's security release of 14 November 2023
Patch Tuesday, November 2023
As of , CISA lists four of the 57 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2023-36025, Windows SmartScreen Security Feature Bypass.
On CISA's list of exploited vulnerabilities
- CVE-2023-36025Windows SmartScreen Security Feature Bypass. Listed by CISA on 14 November 2023, release day
- CVE-2023-36424Windows Common Log File System Driver Elevation of Privilege. Listed by CISA on 13 April 2026, 881 days after the release
- CVE-2023-36036Windows Cloud Files Mini Filter Driver Elevation of Privilege. Listed by CISA on 14 November 2023, release day
- CVE-2023-36033Windows DWM Core Library Elevation of Privilege. Listed by CISA on 14 November 2023, release day
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 57 CVEs |
| On CISA's list of exploited vulnerabilities | 4 CVEs |
| CISA's SSVC exploitation: active | 4 CVEs |
| CISA's SSVC exploitation: proof of concept | 2 CVEs |
| CISA's SSVC exploitation: none | 41 CVEs |
| Not assessed by CISA's SSVC | 10 CVEs |
| Critical by CVSS (9.0 or more) | 2 CVEs |
| EPSS 0.10 or more | 13 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2023-36025Windows SmartScreen Security Feature Bypass | Active | Patch this weekListed | 8.8 High | 0.88 |
| 2 | CVE-2023-36424Windows Common Log File System Driver Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.12 |
| 3 | CVE-2023-36036Windows Cloud Files Mini Filter Driver Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.17 |
| 4 | CVE-2023-36033Windows DWM Core Library Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.11 |
| 5 | CVE-2023-36038ASP.NET Core Denial of Service | Proof of concept | Not on CISA's list | 8.2 High | 0.03 |
| 6 | CVE-2023-36558ASP.NET Core Security Feature Bypass | Proof of concept | Not on CISA's list | 6.2 Medium | 0.01 |
| 7 | CVE-2023-36035Microsoft Exchange Server Spoofing | None | Not on CISA's list | 8.0 High | 0.87 |
| 8 | CVE-2023-36039Microsoft Exchange Server Spoofing | None | Not on CISA's list | 8.0 High | 0.73 |
| 9 | CVE-2023-36041Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.57 |
| 10 | CVE-2023-36050Microsoft Exchange Server Spoofing | None | Not on CISA's list | 8.0 High | 0.39 |
| 11 | CVE-2023-36413Microsoft Office Security Feature Bypass | None | Not on CISA's list | 6.5 Medium | 0.30 |
| 12 | CVE-2023-36017Windows Scripting Engine Memory Corruption | None | Not on CISA's list | 8.8 High | 0.25 |
| 13 | CVE-2023-36052Azure CLI REST Command Information Disclosure | None | Not on CISA's list | 8.6 High | 0.21 |
| 14 | CVE-2023-36397Windows Pragmatic General Multicast (PGM) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.18 |
| 15 | CVE-2023-36049.NET, .NET Framework, and Visual Studio Elevation of Privilege | Not assessed | Not on CISA's list | 7.6 High | 0.13 |
| 16 | CVE-2023-36399Windows Storage Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.08 |
| 17 | CVE-2023-36394Windows Search Service Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.07 |
| 18 | CVE-2023-36439Microsoft Exchange Server Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.05 |
| 19 | CVE-2023-36400Windows HMAC Key Derivation Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.04 |
| 20 | CVE-2023-36028Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.03 |
| 21 | CVE-2023-36560ASP.NET Security Feature Bypass | None | Not on CISA's list | 8.8 High | 0.03 |
| 22 | CVE-2023-38177Microsoft SharePoint Server Remote Code Execution | Not assessed | Not on CISA's list | 6.1 Medium | 0.03 |
| 23 | CVE-2023-36402Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 24 | CVE-2023-36423Microsoft Remote Registry Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 25 | CVE-2023-36437Azure DevOps Server Remote Code Execution | Not assessed | Not on CISA's list | 8.8 High | 0.02 |
| 26 | CVE-2023-38151Microsoft Host Integration Server 2020 Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 27 | CVE-2023-36021Microsoft On-Prem Data Gateway Security Feature Bypass | None | Not on CISA's list | 8.0 High | 0.02 |
| 28 | CVE-2023-36018Visual Studio Code Jupyter Extension Spoofing | None | Not on CISA's list | 7.8 High | 0.02 |
| 29 | CVE-2023-36396Windows Compressed Folder Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.02 |
| 30 | CVE-2023-36407Windows Hyper-V Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.02 |
| 31 | CVE-2023-36392DHCP Server Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 32 | CVE-2023-36395Windows Deployment Services Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 33 | CVE-2023-36401Microsoft Remote Registry Service Remote Code Execution | None | Not on CISA's list | 7.2 High | 0.02 |
| 34 | CVE-2023-36425Windows Distributed File System (DFS) Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 35 | CVE-2023-36037Microsoft Excel Security Feature Bypass | None | Not on CISA's list | 7.8 High | 0.01 |
| 36 | CVE-2023-36045Microsoft Office Graphics Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 37 | CVE-2023-36047Windows Authentication Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 38 | CVE-2023-36393Windows User Interface Application Core Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 39 | CVE-2023-36408Windows Hyper-V Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 40 | CVE-2023-36422Microsoft Windows Defender Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 41 | CVE-2023-36705Windows Installer Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.01 |
| 42 | CVE-2023-36719Microsoft Speech Application Programming Interface (SAPI) Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.01 |
| 43 | CVE-2023-36007Microsoft Send Customer Voice survey from Dynamics 365 Spoofing | None | Not on CISA's list | 7.6 High | 0.01 |
| 44 | CVE-2023-36031Microsoft Dynamics 365 (on-premises) Cross-site Scripting | None | Not on CISA's list | 7.6 High | 0.01 |
| 45 | CVE-2023-36410Microsoft Dynamics 365 (on-premises) Cross-site Scripting | None | Not on CISA's list | 7.6 High | 0.01 |
| 46 | CVE-2023-36046Windows Authentication Denial of Service | None | Not on CISA's list | 7.1 High | 0.01 |
| 47 | CVE-2023-36403Windows Kernel Elevation of Privilege | Not assessed | Not on CISA's list | 7.0 High | 0.01 |
| 48 | CVE-2023-36427Windows Hyper-V Elevation of Privilege | Not assessed | Not on CISA's list | 7.0 High | 0.01 |
| 49 | CVE-2023-36043Open Management Infrastructure Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 50 | CVE-2023-36398Windows NTFS Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 51 | CVE-2023-36016Microsoft Dynamics 365 (on-premises) Cross-site Scripting | None | Not on CISA's list | 6.2 Medium | 0.01 |
| 52 | CVE-2023-36042Visual Studio Denial of Service | None | Not on CISA's list | 6.2 Medium | 0.01 |
| 53 | CVE-2023-36030Microsoft Dynamics 365 Sales Spoofing | None | Not on CISA's list | 6.1 Medium | 0.01 |
| 54 | CVE-2023-36404Windows Kernel Information Disclosure | Not assessed | Not on CISA's list | 5.5 Medium | 0.01 |
| 55 | CVE-2023-36406Windows Hyper-V Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 56 | CVE-2023-36428Microsoft Local Security Authority Subsystem Service Information Disclosure | Not assessed | Not on CISA's list | 5.5 Medium | 0.01 |
| 57 | CVE-2023-36405Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 14 November 2023, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.