Microsoft has released its July 2023 Patch Tuesday security updates to fix multiple vulnerabilities across its products, including six reported vulnerabilities that are currently being exploited in the wild. 

Based on the official release notes from Microsoft, there are a total of 132 vulnerabilities. Of these vulnerabilities, 9 are classified as critical, 122 are classified as important, and 1 are classified as none.

_____________________________

A. List of Vulnerabilities

CVE NumberCVE TitleExploitedImpactMax Severity
CVE-2023-36872VP9 Video Extensions Information Disclosure VulnerabilityNoInformation DisclosureImportant
CVE-2023-36871Azure Active Directory Security Feature Bypass VulnerabilityNoSecurity Feature BypassImportant
CVE-2023-36868Azure Service Fabric on Windows Information Disclosure VulnerabilityNoInformation DisclosureImportant
CVE-2023-36867Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-35374Paint 3D Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-35373Mono Authenticode Validation Spoofing VulnerabilityNoSpoofingImportant
CVE-2023-35367Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityNoRemote Code ExecutionCritical
CVE-2023-35366Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityNoRemote Code ExecutionCritical
CVE-2023-35365Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityNoRemote Code ExecutionCritical
CVE-2023-35364Windows Kernel Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35363Windows Kernel Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35362Windows Clip Service Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35361Windows Kernel Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35360Windows Kernel Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35358Windows Kernel Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35357Windows Kernel Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35356Windows Kernel Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35353Connected User Experiences and Telemetry Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35352Windows Remote Desktop Security Feature Bypass VulnerabilityNoSecurity Feature BypassCritical
CVE-2023-35351Windows Active Directory Certificate Services (AD CS) Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-35350Windows Active Directory Certificate Services (AD CS) Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-35348Active Directory Federation Service Security Feature Bypass VulnerabilityNoSecurity Feature BypassImportant
CVE-2023-35347Microsoft Install Service Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35346Windows DNS Server Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-35345Windows DNS Server Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-35344Windows DNS Server Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-35343Windows Geolocation Service Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-35342Windows Image Acquisition Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35341Microsoft DirectMusic Information Disclosure VulnerabilityNoInformation DisclosureImportant
CVE-2023-35340Windows CNG Key Isolation Service Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35339Windows CryptoAPI  Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-35338Windows Peer Name Resolution Protocol Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-35337Win32k Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35336Windows MSHTML Platform Security Feature Bypass VulnerabilityNoSecurity Feature BypassImportant
CVE-2023-35335Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityNoSpoofingImportant
CVE-2023-35333MediaWiki PandocUpload Extension Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-35332Windows Remote Desktop Protocol Security Feature BypassNoSecurity Feature BypassImportant
CVE-2023-35331Windows Local Security Authority (LSA) Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-35330Windows Extended Negotiation Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-35329Windows Authentication Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-35328Windows Transaction Manager Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35326Windows CDP User Components Information Disclosure VulnerabilityNoInformation DisclosureImportant
CVE-2023-35325Windows Print Spooler Information Disclosure VulnerabilityNoInformation DisclosureImportant
CVE-2023-35324Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityNoInformation DisclosureImportant
CVE-2023-35323Windows OLE Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-35322Windows Deployment Services Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-35321Windows Deployment Services Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-35320Connected User Experiences and Telemetry Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35319Remote Procedure Call Runtime Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-35318Remote Procedure Call Runtime Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-35317Windows Server Update Service (WSUS) Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35316Remote Procedure Call Runtime Information Disclosure VulnerabilityNoInformation DisclosureImportant
CVE-2023-35315Windows Layer-2 Bridge Network Driver Remote Code Execution VulnerabilityNoRemote Code ExecutionCritical
CVE-2023-35314Remote Procedure Call Runtime Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-35313Windows Online Certificate Status Protocol (OCSP) SnapIn Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-35312Microsoft VOLSNAP.SYS Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35310Windows DNS Server Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-35309Microsoft Message Queuing Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-35308Windows MSHTML Platform Security Feature Bypass VulnerabilityNoSecurity Feature BypassImportant
CVE-2023-35306Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityNoInformation DisclosureImportant
CVE-2023-35305Windows Kernel Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35304Windows Kernel Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35303USB Audio Class System Driver Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-35302Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-35300Remote Procedure Call Runtime Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-35299Windows Common Log File System Driver Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-35298HTTP.sys Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-35297Windows Pragmatic General Multicast (PGM) Remote Code Execution VulnerabilityNoRemote Code ExecutionCritical
CVE-2023-35296Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityNoInformation DisclosureImportant
CVE-2023-33174Windows Cryptographic Information Disclosure VulnerabilityNoInformation DisclosureImportant
CVE-2023-33173Remote Procedure Call Runtime Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-33172Remote Procedure Call Runtime Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-33171Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityNoSpoofingImportant
CVE-2023-33170ASP.NET and Visual Studio Security Feature Bypass VulnerabilityNoSecurity Feature BypassImportant
CVE-2023-33169Remote Procedure Call Runtime Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-33168Remote Procedure Call Runtime Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-33167Remote Procedure Call Runtime Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-33166Remote Procedure Call Runtime Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-33165Microsoft SharePoint Server Security Feature Bypass VulnerabilityNoSecurity Feature BypassImportant
CVE-2023-33164Remote Procedure Call Runtime Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-33163Windows Network Load Balancing Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-33162Microsoft Excel Information Disclosure VulnerabilityNoInformation DisclosureImportant
CVE-2023-33161Microsoft Excel Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-33160Microsoft SharePoint Server Remote Code Execution VulnerabilityNoRemote Code ExecutionCritical
CVE-2023-33159Microsoft SharePoint Server Spoofing VulnerabilityNoSpoofingImportant
CVE-2023-33158Microsoft Excel Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-33157Microsoft SharePoint Remote Code Execution VulnerabilityNoRemote Code ExecutionCritical
CVE-2023-33156Microsoft Defender Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-33155Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-33154Windows Partition Management Driver Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-33153Microsoft Outlook Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-33152Microsoft ActiveX Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-33151Microsoft Outlook Spoofing VulnerabilityNoSpoofingImportant
CVE-2023-33150Microsoft Office Security Feature Bypass VulnerabilityNoSecurity Feature BypassImportant
CVE-2023-33149Microsoft Office Graphics Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-33148Microsoft Office Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-33134Microsoft SharePoint Server Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-33127.NET and Visual Studio Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-32085Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityNoInformation DisclosureImportant
CVE-2023-32084HTTP.sys Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-32083Microsoft Failover Cluster Information Disclosure VulnerabilityNoInformation DisclosureImportant
CVE-2023-32057Microsoft Message Queuing Remote Code Execution VulnerabilityNoRemote Code ExecutionCritical
CVE-2023-32056Windows Server Update Service (WSUS) Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-32055Active Template Library Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-32054Volume Shadow Copy Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-32053Windows Installer Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-32052Microsoft Power Apps (online) Spoofing VulnerabilityNoSpoofingImportant
CVE-2023-32051Raw Image Extension Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-32050Windows Installer Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-32047Paint 3D Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-32045Microsoft Message Queuing Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-32044Microsoft Message Queuing Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-32043Windows Remote Desktop Security Feature Bypass VulnerabilityNoSecurity Feature BypassImportant
CVE-2023-32042OLE Automation Information Disclosure VulnerabilityNoInformation DisclosureImportant
CVE-2023-32041Windows Update Orchestrator Service Information Disclosure VulnerabilityNoInformation DisclosureImportant
CVE-2023-32040Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityNoInformation DisclosureImportant
CVE-2023-32039Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityNoInformation DisclosureImportant
CVE-2023-32038Microsoft ODBC Driver Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-32037Windows Layer-2 Bridge Network Driver Information Disclosure VulnerabilityNoInformation DisclosureImportant
CVE-2023-32035Remote Procedure Call Runtime Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-32034Remote Procedure Call Runtime Denial of Service VulnerabilityNoDenial of ServiceImportant
CVE-2023-32033Microsoft Failover Cluster Remote Code Execution VulnerabilityNoRemote Code ExecutionImportant
CVE-2023-29347Windows Admin Center Spoofing VulnerabilityNoSpoofingImportant
CVE-2023-21756Windows Win32k Elevation of Privilege VulnerabilityNoElevation of PrivilegeImportant
CVE-2023-21526Windows Netlogon Information Disclosure VulnerabilityNoInformation DisclosureImportant
ADV230002Microsoft Guidance for Addressing Security Feature Bypass in Trend Micro EFI ModulesNoSecurity Feature BypassImportant
CVE-2023-36884Office and Windows HTML Remote Code Execution VulnerabilityYesRemote Code ExecutionImportant
CVE-2023-36874Windows Error Reporting Service Elevation of Privilege VulnerabilityYesElevation of PrivilegeImportant
CVE-2023-35311Microsoft Outlook Security Feature Bypass VulnerabilityYesSecurity Feature BypassImportant
CVE-2023-32049Windows SmartScreen Security Feature Bypass VulnerabilityYesSecurity Feature BypassImportant
CVE-2023-32046Windows MSHTML Platform Elevation of Privilege VulnerabilityYesElevation of PrivilegeImportant
ADV230001Guidance on Microsoft Signed Drivers Being Used MaliciouslyYesDefense in DepthNone

_____________________________

B. Actions to be Taken

CERT-PH recommends the following actions be taken:

  • Kindly review and apply the necessary updates to mitigate future threats.
  • For additional information, kindly refer to the official report
    • https://msrc.microsoft.com/update-guide/releaseNote/2023-Jul
    • https://msrc.microsoft.com/update-guide/vulnerability