CVE-2023-36584

MEDIUM KEV

Windows Mark of the Web - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-36584 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 16, 2023.

Description

Windows Mark of the Web Security Feature Bypass Vulnerability

References (2)

Core 2

Scores

CVSS v3 5.4
EPSS 0.1542
EPSS Percentile 94.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2023-11-16
VulnCheck KEV 2023-11-13
InTheWild.io 2023-11-16
ENISA EUVD EUVD-2023-40529
Status published
Products (13)
microsoft/windows_10_1507 < 10.0.10240.20232 (2 CPE variants)
microsoft/windows_10_1809 < 10.0.17763.4974 (3 CPE variants)
microsoft/windows_10_21h1 < 10.0.19041.3570 (3 CPE variants)
microsoft/windows_10_22h2 < 10.0.19041.3570 (3 CPE variants)
microsoft/windows_11_21h2 < 10.0.22000.2538 (2 CPE variants)
microsoft/windows_11_22h2 < 10.0.22621.2428 (2 CPE variants)
microsoft/windows_server_2008 (2 CPE variants)
microsoft/windows_server_2008 r2 sp1
microsoft/windows_server_2012
microsoft/windows_server_2012 r2
... and 3 more
Published Oct 10, 2023
KEV Added Nov 16, 2023
Tracked Since Feb 18, 2026