Microsoft’s September 2023 Patch Tuesday Addresses 61 CVEs (CVE-2023-36761)

Microsoft patched 61 CVEs in its September Patch Tuesday release, with five rated critical, 55 rated important and one rated moderate.

Remote code execution (RCE) vulnerabilities accounted for 39.3% of the vulnerabilities patched this month, followed by elevation of privilege (EoP) vulnerabilities at 27.9%. Of the 61 CVEs patched this month, two vulnerabilities were exploited in the wild as zero-day vulnerabilities. 

CVE-2023-36761 is an information disclosure vulnerability in Microsoft Word. According to Microsoft, it has been exploited in the wild as a zero-day and was publicly disclosed prior to a patch being available. 

CVE-2023-36802 is an EoP vulnerability in the Microsoft Streaming Service Proxy. According to Microsoft, it has been exploited in the wild as a zero-day. 

For more information about the September 2023 Patch Tuesday release, including the availability of Tenable product coverage, please visit our blog.