Patch Tuesday, September 2023
Microsoft's monthly security release, Tuesday, September 12, 2023. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
2 CVEs · 0 critical · 2 exploited · 1 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
2 CVEs · 0 critical · 2 exploited · 1 with public exploit code
- 7.8HighSep 12, 2023Microsoft Streaming Service Proxy Memory corruptionCVE-2023-36802Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation.Exploited28% likelyExploit code
- 6.5MediumSep 12, 2023Microsoft Word Information disclosureCVE-2023-36761Microsoft Word contains an unspecified vulnerability that allows for information disclosure.Exploited20% likely
Adobe
2 CVEs · 0 critical · 2 exploited · 1 with public exploit code
- 7.5HighSep 14, 2023Adobe ColdFusion Auth bypass / access controlCVE-2023-38205Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.Exploited100% likelyExploit codeNucleiDetection
- 7.8HighSep 13, 2023Adobe Acrobat and Reader Memory corruptionCVE-2023-26369Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.Exploited6.7% likely
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.