CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

CVE	Vendor	Product	Added	Due	Status
CVE-2023-41763 — Microsoft Skype for Business Privilege Escalation Vulnerability Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation.	Microsoft	Skype for Business	Oct 10, 2023	Oct 31, 2023
CVE-2023-28229 — Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.	Microsoft	Windows CNG Key Isolation Service	Oct 4, 2023	Oct 25, 2023
CVE-2023-36761 — Microsoft Word Information Disclosure Vulnerability Microsoft Word contains an unspecified vulnerability that allows for information disclosure.	Microsoft	Word	Sep 12, 2023	Oct 3, 2023
CVE-2023-36802 — Microsoft Streaming Service Proxy Privilege Escalation Vulnerability Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation.	Microsoft	Streaming Service Proxy	Sep 12, 2023	Oct 3, 2023
CVE-2023-38180 — Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS).	Microsoft	.NET Core and Visual Studio	Aug 9, 2023	Aug 30, 2023
CVE-2023-36884 — Microsoft Windows Search Remote Code Execution Vulnerability Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.	Microsoft	Windows	Jul 17, 2023	Aug 29, 2023	Ransomware
CVE-2023-32046 — Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation.	Microsoft	Windows	Jul 11, 2023	Aug 1, 2023
CVE-2023-32049 — Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt.	Microsoft	Windows	Jul 11, 2023	Aug 1, 2023
CVE-2023-35311 — Microsoft Outlook Security Feature Bypass Vulnerability Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt.	Microsoft	Outlook	Jul 11, 2023	Aug 1, 2023
CVE-2023-36874 — Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation.	Microsoft	Windows	Jul 11, 2023	Aug 1, 2023

Microsoft

CVE-2023-41763 — Microsoft Skype for Business Privilege Escalation Vulnerability

Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation.

Skype for Business · Oct 10, 2023

Microsoft

CVE-2023-28229 — Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability

Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.

Windows CNG Key Isolation Service · Oct 4, 2023

Microsoft

CVE-2023-36761 — Microsoft Word Information Disclosure Vulnerability

Microsoft Word contains an unspecified vulnerability that allows for information disclosure.

Word · Sep 12, 2023

Microsoft

CVE-2023-36802 — Microsoft Streaming Service Proxy Privilege Escalation Vulnerability

Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation.

Streaming Service Proxy · Sep 12, 2023

Microsoft

CVE-2023-38180 — Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability

Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS).

.NET Core and Visual Studio · Aug 9, 2023

Ransomware Microsoft

CVE-2023-36884 — Microsoft Windows Search Remote Code Execution Vulnerability

Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.

Windows · Jul 17, 2023

Microsoft

CVE-2023-32046 — Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability

Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation.

Windows · Jul 11, 2023

Microsoft

CVE-2023-32049 — Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability

Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt.

Windows · Jul 11, 2023

Microsoft

CVE-2023-35311 — Microsoft Outlook Security Feature Bypass Vulnerability

Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt.

Outlook · Jul 11, 2023

Microsoft

CVE-2023-36874 — Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability

Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation.

Windows · Jul 11, 2023