Microsoft fixes two actively exploited bugs, one used by BlackLotus bootkit (CVE-2023-29336, CVE-2023-24932)

CVE-2016-3309 is a privilege escalation vulnerability in the Microsoft Windows kernel caused by improper handling of objects in memory. Triggering it typically requires getting crafted code to run on the system (the usual pattern for kernel EoP flaws), after which the kernel mishandles the objects and the attacker can execute arbitrary code in kernel mode. Successful exploitation grants full system-level privileges, letting an attacker disable security tooling, steal credentials, and deploy payloads such as ransomware. CISA lists the affected product broadly as Microsoft Windows, with older and legacy Windows builds being the most likely remaining targets for this 2016-era flaw. Exploitation is confirmed in the wild: the flaw was added to the CISA KEV catalog on 2022-03-15 with known ransomware use, and EPSS assigns a 20.6% probability of exploitation in the next 30 days (97th percentile).

Do: Apply Microsoft's kernel-mode security updates per vendor instructions on all Windows systems, prioritizing legacy/out-of-support builds where this flaw is most likely to remain unpatched. Since the bug is KEV-listed with known ransomware use, verify patch deployment fleet-wide and inventory any Windows hosts that can no longer receive updates, isolating them or applying compensating controls. There is no public PoC, but treat unpatched Windows endpoints with local user or execution access as high priority for remediation.

CVE-2021-1732 is a local elevation-of-privilege vulnerability (CWE-787, out-of-bounds write) in Microsoft's Win32k kernel driver, publicly characterized as an "offset confusion" in the Win32k ConsoleControl routine. It is triggered locally: a process with only low privileges can invoke the vulnerable Win32k functionality without any user interaction, causing a user-supplied offset/pointer to be mishandled in kernel mode and memory to be written out of bounds. An attacker who successfully exploits the flaw can execute code in the kernel and elevate to SYSTEM, gaining full control of the host — which makes it a valuable second-stage link in malware and ransomware chains. Any system running the affected Windows 10 releases (1803, 1809, 1909, 2004, 20H2) or Windows Server 2019/1909/2004/20H2 is exposed, though exploitation requires the attacker to already run code locally on the target. The flaw was fixed in Microsoft's February 2021 Patch Tuesday updates, was added to CISA's KEV catalog on 2021-11-03 with known ransomware use, and carries a very high EPSS score (78.4%, 100th percentile), indicating sustained exploitation pressure.

Do: Apply Microsoft's February 2021 (or later) Windows cumulative security updates to all affected Windows 10 and Windows Server systems, per vendor instructions — CISA's KEV listing requires federal agencies to patch. Prioritize hosts exposed to untrusted local users or already compromised by malware (e.g., ransomware or Raspberry Robin activity, which has used chained Windows LPEs), and hunt on unpatched hosts for signs of post-exploitation privilege escalation to SYSTEM.

Microsoft's Win32k kernel driver contains a use-after-free (CWE-416) local privilege escalation vulnerability (CVE-2021-40449) affecting Windows client versions from Windows 7 through Windows 11 21H2. A local attacker who can already execute code on a system can trigger the flaw — demonstrated in a public proof of concept via the NtGdiResetDC system call — to corrupt kernel memory and elevate to SYSTEM-level privileges with high impact on confidentiality, integrity, and availability (CVSS 7.8, local vector, no user interaction). Any Windows desktop or laptop running the affected versions is exposed to any unprivileged process or malware that gains a foothold on the device. The bug was exploited as a zero-day in the wild before being fixed; CISA added it to the KEV catalog on 2021-11-17 with known ransomware use, and public reporting ties exploitation to the MysterySnail RAT campaign (including the lightweight MysteryMonoSnail backdoor). EPSS places the flaw in the 99th percentile, with a 74.1% probability of exploitation activity within 30 days.

Do: Apply Microsoft's security updates addressing this Win32k flaw via Windows Update on all affected Windows 7, 8.1, 10, and 11 clients, per the CISA KEV required action, and verify inventories show no unpatched Windows 10 builds (1507–21H1) or Windows 11 21H2 endpoints. Because this was a zero-day exploited in the wild — including in campaigns involving MysterySnail and ransomware use noted by CISA — treat patching as urgent on all endpoints. Until patched, limit execution of untrusted or unprivileged local code on these systems.

CVE-2022-21882 is a Win32k elevation-of-privilege vulnerability caused by an out-of-bounds write (CWE-787) in the Windows kernel's Win32k component, affecting Windows 10 versions 1809 through 21H2, Windows 11 21H2, and Windows Server 2019, 2022, and version 20H2. A local attacker who can already execute code with a low-privileged account can trigger the flaw via Win32k system calls with no user interaction, corrupting kernel memory and escalating to SYSTEM-level privileges. Successful exploitation gives the attacker full control of the compromised host (high confidentiality, integrity, and availability impact), and it is commonly chained after an initial foothold to deploy ransomware or other payloads. Anyone running the affected Windows 10, Windows 11, or Windows Server builds is exposed, because the vulnerable Win32k code ships by default with those operating systems. The flaw is actively exploited in the wild: it is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-04) with known ransomware use, and public proof-of-concept code was released by researchers after disclosure.

Do: Apply Microsoft's cumulative security updates for Windows 10 (1809–21H2), Windows 11 21H2, and Windows Server 2019/2022/20H2 immediately — the fix shipped in Microsoft's January 2022 Patch Tuesday and is included in all later cumulative updates; per CISA's required action, apply updates per vendor instructions. Prioritize multi-user hosts (RDS/VDI, terminal and jump servers) where local privilege escalation is most damaging, and hunt for post-compromise indicators such as unexpected SYSTEM-level processes, since ransomware operators are known to use this bug after gaining an initial foothold. If patching is delayed, limit local code execution on affected systems and watch EDR telemetry for kernel-level privilege-escalation behavior.

Secure Boot Security Feature Bypass Vulnerability

Windows Network File System Remote Code Execution Vulnerability

CVE-2023-23397 is an elevation of privilege vulnerability in Microsoft Outlook caused by improper input validation (CWE-20) combined with authentication bypass via spoofed authentication data on the channel (CWE-294), allowing an attacker to force Outlook to authenticate to an attacker-controlled SMB/WebDAV server. It is triggered when Outlook processes a crafted email or calendar object — for example a meeting or task reminder whose sound property points to an attacker-supplied UNC path — and requires no user interaction. That authentication exchange leaks the victim's NTLM credential hash, which the attacker can crack offline or relay to authenticate as the victim and access resources such as Exchange mailboxes, effectively escalating privileges. Affected software spans Microsoft 365 Apps, Microsoft Office (including the Long Term Servicing Channel), and Microsoft Outlook, which are deployed across enterprises, governments, and militaries worldwide. It is actively exploited in the wild — added to CISA's Known Exploited Vulnerabilities catalog on 2023-03-14 with a 97.4% EPSS — and Microsoft has warned of exploitation by Russia-aligned threat actors in campaigns against government and military mail servers, with patches shipped in Microsoft's March 2023 security updates.

Do: Apply Microsoft's March 2023 security updates to Microsoft 365 Apps, Office/LTSC, and Outlook immediately, per CISA's required action. As interim mitigation, enable Extended Protection for Authentication or add accounts to the Protected Users group to block the NTLM credential leak, and audit calendar and task reminder sound properties for UNC paths (Microsoft published an audit/cleanup script for this) while watching for unexpected outbound SMB/WebDAV connections from hosts running Outlook.

Windows OLE Remote Code Execution Vulnerability

Windows Network File System Remote Code Execution Vulnerability

CVE-2023-24955 is a code injection vulnerability (CWE-94) in on-premises Microsoft SharePoint Server that enables remote code execution over the network (CVSS 3.1: 7.2, AV:N/AC:L/PR:H/UI:N). Exploitation requires authentication with high privileges — e.g., a SharePoint site administrator account — and no user interaction, so an attacker who has obtained elevated site credentials can send crafted requests that execute code on the SharePoint server. A successful attacker gains code execution in the context of the SharePoint service, with high impact on confidentiality, integrity, and availability, providing a foothold for lateral movement or ransomware deployment. Organizations running affected on-premises SharePoint Server releases are affected; the flaw was demonstrated at Pwn2Own and Microsoft patched it in the May 2023 Patch Tuesday updates. The bug is now exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-03-26 with known ransomware use, and EPSS places its 30-day exploitation probability at 85.4% (100th percentile).

Do: Apply Microsoft's May 2023 (or later) security updates for SharePoint Server immediately, prioritizing internet-facing servers; CISA's KEV entry requires federal agencies to apply vendor mitigations or discontinue use of the product. Audit and tighten accounts holding SharePoint site-administrator rights, and hunt for signs of exploitation such as unexpected site-admin activity or unusual process launches from SharePoint service accounts. Public reporting on the 2024 exploitation suggests it may be chained with SharePoint privilege-escalation flaw CVE-2023-29357 to achieve unauthenticated access, so ensure both flaws are patched.

CVE-2023-29336 is a use-after-free flaw (CWE-416) in Microsoft's Win32k kernel component that allows privilege escalation to SYSTEM. It is triggered by code running on a Windows host that causes the Win32k driver to reference freed kernel memory; the exact trigger path is not detailed in the available data, but as a kernel elevation-of-privilege issue it requires local code execution or an attacker already holding a foothold on the machine. A successful exploit grants SYSTEM privileges, giving the attacker full control of the compromised host. Because Win32k ships in every supported Windows client and server, effectively the entire Windows installed base is exposed to the flaw. The vulnerability is confirmed exploited in the wild — CISA added it to the KEV catalog on 2023-05-09 — and EPSS places its 30-day exploitation probability at 40.9% (99th percentile), though no public proof-of-concept is known and ransomware use is unconfirmed.

Do: Apply Microsoft's current cumulative Windows security updates (issued May 2023, per the CISA KEV required action) across all Windows clients and servers, prioritizing servers and systems exposed to untrusted users since the flaw is being actively exploited. Until patched, limit untrusted local code execution and restrict remote entry points such as RDP, because local privilege escalation flaws are commonly chained into full compromises. Verify update installation after deployment; specific affected build numbers and any ransomware involvement are not stated in the available data.