Patch Tuesday, July 2023
Microsoft's monthly security release, Tuesday, July 11, 2023. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
5 CVEs · 0 critical · 5 exploited · 2 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
5 CVEs · 0 critical · 5 exploited · 2 with public exploit code
- 7.8HighJul 11, 2023Microsoft Windows Path traversal / file handlingCVE-2023-36874Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation.Exploited43% likelyExploit codeMetasploitDetection
- 7.5HighJul 11, 2023Microsoft Windows Code / command injectionCVE-2023-36884Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.Exploited99% likelyExploit codeDetection
- 8.8HighJul 11, 2023Microsoft WindowsCVE-2023-32049Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt.Exploited4.2% likely
- 8.8HighJul 11, 2023Microsoft OutlookCVE-2023-35311Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt.Exploited16% likely
- 7.8HighJul 11, 2023Microsoft Windows Privilege escalationCVE-2023-32046Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation.Exploited10% likely
Adobe
2 CVEs · 1 critical · 2 exploited · 2 with public exploit code
- 9.8CriticalJul 12, 2023Adobe ColdFusion DeserializationCVE-2023-29300Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.Exploited100% likelyExploit codeNucleiDetection
- 7.5HighJul 12, 2023Adobe ColdFusion Auth bypass / access controlCVE-2023-29298Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.Exploited100% likelyExploit codeNucleiDetection
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.