Patch Tuesday, April 2023
Microsoft's monthly security release, Tuesday, April 11, 2023. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
2 CVEs · 0 critical · 2 exploited · 2 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
2 CVEs · 0 critical · 2 exploited · 2 with public exploit code
- 7.8HighApr 11, 2023Microsoft Windows Memory corruptionCVE-2023-28252Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.Exploited49% likelyExploit codeMetasploit
- 7.0HighApr 11, 2023Microsoft Windows CNG Key Isolation Service Privilege escalationCVE-2023-28229Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.Exploited1.7% likelyExploit code
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.