EXPOSURES › CVE-2023-36884
CVE-2023-36884
CRITICAL ⌖ ON CISA KEV · EXPLOITEDA Microsoft Windows Search vulnerability allowed attackers to bypass MOTW protections and execute remote code via malicious files.
This unpatched RCE flaw in Windows Search let adversaries evade MOTW defenses using crafted files, enabling remote code execution. DIB organizations must ensure all Windows systems are patched and monitored for KEV-listed threats to prevent ransomware and data breaches. The vulnerability was actively exploited in the wild, highlighting the risk of relying on unpatched Microsoft products.
Shame score — Microsoft failed to patch a known, actively exploited RCE vulnerability in a core OS component, allowing ransomware actors to bypass MOTW protections and execute arbitrary code.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |