CVE-2023-28229

CVE-2023-28229 is an elevation-of-privilege vulnerability in the Windows CNG Key Isolation Service (KeyIso), the component that isolates and protects private keys used for cryptographic operations on Windows. A local attacker with low privileges can trigger the flaw inside the service under specific conditions (CVSS attack complexity is high); no user interaction is required. Successful exploitation grants elevated privileges with high impact on confidentiality, integrity, and availability, effectively full control of the affected host, and is typically used to strengthen a low-privileged foothold already gained via another flaw. All supported Windows 10 releases (1507 through 22H2), Windows 11 21H2 and 22H2, and Windows Server 2008, 2012, 2016, and 2019 are affected. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2023-10-04, indicating active exploitation; no public proof-of-concept is known and ransomware use is listed as unknown.

What to do: Apply Microsoft's October 2023 security updates (or later cumulative updates) on all affected Windows 10, Windows 11, and Windows Server systems, prioritizing multi-user hosts such as RDS/VDI servers and endpoints used by potentially compromised accounts, since exploitation requires local access. Verify patch status via your patch-management inventory and hunt for signs of local privilege escalation on hosts missing the fix. Note that the related KEV batch also flagged JetBrains TeamCity (CVE-2023-42793), which should be patched separately if deployed.