Actively exploited · Published Jul 11, 2023 · Assigned by microsoft
CVE-2023-36884Windows Search Remote Code Execution Vulnerability
High 7.5 Exploited Ransomware
In plain English
A high-severity race condition in Windows 10 Version 1507 from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on July 17, 2023). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 99.4% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Aug 29, 2023.
Official description
Windows Search Remote Code Execution Vulnerability
Affected products (as reported)
Weakness: CWE-362 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
References
- Windows Search Remote Code Execution Vulnerability vendor-advisory, patch
- http://seclists.org/fulldisclosure/2023/Jul/43 x_transferred
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36884 government-resource