PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-36761 Microsoft CVE debrief

CVE-2023-36761 is an information disclosure vulnerability in Microsoft Word that CISA added to its Known Exploited Vulnerabilities catalog on 2023-09-12. Because it is listed in KEV, defenders should treat it as a high-priority issue: apply Microsoft’s mitigations or stop using the affected product if mitigations are unavailable. The public record provided here does not include exploit details, but the KEV designation indicates known exploitation.

Vendor
Microsoft
Product
Word
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2023-09-12
Original CVE updated
2023-09-12
Advisory published
2023-09-12
Advisory updated
2023-09-12

Who should care

Security teams, endpoint administrators, and Microsoft 365 / Microsoft Word owners should care most. Any organization that permits Word documents on managed endpoints should prioritize this CVE, especially if patching and mitigation enforcement are centrally managed.

Technical summary

The source corpus identifies CVE-2023-36761 as a Microsoft Word information disclosure vulnerability. CISA’s KEV entry marks it as a known exploited vulnerability and directs affected users to apply vendor mitigations or discontinue use of the product if mitigations are unavailable. The supplied materials do not include CVSS scoring, attack vector details, or additional exploitation specifics.

Defensive priority

Urgent. CISA has listed this CVE in the Known Exploited Vulnerabilities catalog, which is a strong signal to accelerate patching, mitigation, and exposure reduction.

Recommended defensive actions

  • Review Microsoft’s advisory for CVE-2023-36761 and apply the recommended fixes or mitigations.
  • If no effective mitigation is available, follow CISA guidance to discontinue use of the affected product until remediation is possible.
  • Confirm endpoint update compliance for systems that use Microsoft Word.
  • Prioritize this vulnerability in patch windows and exception reviews because it is in CISA KEV.
  • Monitor for any vendor or CISA updates related to this CVE and verify remediation status after deployment.

Evidence notes

The supplied source corpus includes CISA KEV metadata for CVE-2023-36761 with vendorProject Microsoft, product Word, dateAdded 2023-09-12, dueDate 2023-10-03, and the requiredAction text to apply vendor mitigations or discontinue use if mitigations are unavailable. The KEV notes reference Microsoft’s MSRC advisory and the NVD record. The CVE.org and NVD links are official reference points, but no detailed technical exploit description was provided in the corpus.

Official resources

Publicly disclosed and cataloged by CISA KEV on 2023-09-12; the KEV due date supplied is 2023-10-03.