CVE-2023-36884

CVE Enrichment

CVSS: 7.5 HIGH
EPSS: 98.93%
EPSS Percentile: 99.93%
CISA KEV: YES — Known Exploited Vulnerability

Description

Windows Search Remote Code Execution Vulnerability

Technical Details

CVSS Version: 3.1
CNA / NVD Source: secure@microsoft.com
Published: 12-Jul-2023 02:15
Last Modified: 10-Aug-2026 23:18
EPSS Date: 2026-10-11
CWE: CWE-362

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:N /
                            UI:R /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2023-07-17
Remediation Due: 2023-08-29
Known Ransomware Campaign Use: Known
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884; https://nvd.nist.gov/vuln/detail/CVE-2023-36884

Affected Products / Versions

microsoft / windows_10_1507
Version / affected range: * · before (exclusive) 10.0.10240.20107
cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*
microsoft / windows_10_1607
Version / affected range: * · before (exclusive) 10.0.14393.6167
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
microsoft / windows_10_1607
Version / affected range: * · before (exclusive) 10.0.14393.6167
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
microsoft / windows_10_1809
Version / affected range: * · before (exclusive) 10.0.17763.4737
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*
microsoft / windows_10_1809
Version / affected range: * · before (exclusive) 10.0.17763.4737
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
microsoft / windows_10_1809
Version / affected range: * · before (exclusive) 10.0.17763.4737
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
microsoft / windows_10_21h2
Version / affected range: * · before (exclusive) 10.0.19044.3324
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*
microsoft / windows_10_22h2
Version / affected range: * · before (exclusive) 10.0.19044.3324
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*
microsoft / windows_11_21h2
Version / affected range: * · before (exclusive) 10.0.22000.2295
cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*
microsoft / windows_11_22h2
Version / affected range: * · before (exclusive) 10.0.22621.2134
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*
microsoft / windows_server_2008
Version / affected range: -
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
microsoft / windows_server_2008
Version / affected range: r2
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
microsoft / windows_server_2012
Version / affected range: -
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
microsoft / windows_server_2012
Version / affected range: r2
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
microsoft / windows_server_2016
Version / affected range: * · before (exclusive) 10.0.14393.6167
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
microsoft / windows_server_2019
Version / affected range: * · before (exclusive) 10.0.17763.4737
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
microsoft / windows_server_2022
Version / affected range: * · before (exclusive) 10.0.20348.1903
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*

References

Last enrichment sync: 12-Oct-2026 01:36
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE-2023-36884: a vulnerability in the Windows Search component that allows commands to be run on the system, bypassing the mark-of-the-web (MoTW) mechanism Kaspersky Reports Rising Vulnerability Disclosures and Early Exploit Releases in Q2 2026

CVE (26)

People (2)

Vendors (2)

Products (15)

Tools (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.