CVE-2023-21715
Published: February 14, 2023
Official Description
Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.
CISA KEV Advisory
Microsoft Office Publisher Security Feature Bypass Vulnerability
Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.
Apply updates per vendor instructions.
Risk Analysis
This flaw in Microsoft Office Publisher allows an authenticated, local attacker to bypass security features on a targeted system. The vulnerability is considered urgent due to its presence in CISA's KEV catalog and confirmed in-the-wild exploitation.
This vulnerability is actively being exploited in the wild, as confirmed by its presence in CISA's KEV. Exploitation requires local and authenticated access to the target system.
Install the latest security updates for Microsoft Office Publisher to address this security feature bypass. Regular patching is crucial for preventing local privilege escalation.
Technical Analysis
CVE-2023-21715 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2023-21715 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Affected Vendors & Products
Exploit & PoC Resources
All References (2)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2023-21715 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1