CISA includes three Microsoft Patch Tuesday vulnerabilities in list of security flaws

    On Tuesday, CISA updated its Known Exploited Vulnerabilities catalog, adding CVE-2023-36033, CVE-2023-36025, and CVE-2023-36036. The agency requires federal civilian agencies to address these issues by December 5.

    CVE-2023-36033 impacts the Microsoft Windows Desktop Window Manager. This zero-day vulnerability, with a CVSS score of 7.8, allows exploitation without high-level privileges or user interaction. It affects Microsoft Windows 10, Microsoft Windows Server 2019, and later versions. Microsoft has confirmed that attackers are exploiting this vulnerability, and a proof of concept exists.

    CVE-2023-36036, affecting the Windows Cloud Files Mini Filter Driver, is also under active attack. It poses a significant risk, especially when paired with a code execution bug. This vulnerability, similar to CVE-2023-36033, has a 7.8 CVSS score. It affects Microsoft Windows 10 and Microsoft Windows Server 2008 onwards.

    The third, CVE-2023-36025, targets the Windows SmartScreen Security Feature. It has the highest CVSS score of 8.8 and is currently under active exploitation. This vulnerability is a SmartScreen Security Feature Bypass. Organizations should not rely solely on SmartScreen for defense.

    Microsoft unveiled 58 vulnerabilities, including these three, which CISA added to its catalog. Alongside Microsoft, other companies like Cisco, Adobe, Google, Fortinet, and more also announced vulnerabilities. These vulnerabilities raise concerns about potential ransomware exploitation.

    Latest articles

    Related articles