CVE-2023-21689
published 2023-02-14CVE-2023-21689: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
PriorityP273critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
26.50%
97.8th percentile
Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1507 | < 10.0.10240.19747 | 10.0.10240.19747 |
| microsoft | windows_10_1607 | < 10.0.14393.5717 | 10.0.14393.5717 |
| microsoft | windows_10_1809 | < 10.0.17763.4010 | 10.0.17763.4010 |
| microsoft | windows_10_20h2 | < 10.0.19042.2604 | 10.0.19042.2604 |
| microsoft | windows_10_21h2 | < 10.0.19044.2604 | 10.0.19044.2604 |
| microsoft | windows_10_22h2 | < 10.0.19045.2604 | 10.0.19045.2604 |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.19747 | 10.0.10240.19747 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.5717 | 10.0.14393.5717 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.4010 | 10.0.17763.4010 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.4010 | 10.0.17763.4010 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.2604 | 10.0.19042.2604 |
| microsoft | windows_10_version_21h2 | >= 10.0.19043.0 < 10.0.19044.2604 | 10.0.19044.2604 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.2604 | 10.0.19045.2604 |
| microsoft | windows_11_21h2 | < 10.0.22000.1574 | 10.0.22000.1574 |
| microsoft | windows_11_22h2 | < 10.0.22621.1265 | 10.0.22621.1265 |
| microsoft | windows_11_version_21h2 | >= 10.0.0 < 10.0.22621.1574 | 10.0.22621.1574 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.1265 | 10.0.22621.1265 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.26366 | 6.1.7601.26366 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.24116 | 6.2.9200.24116 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.20821 | 6.3.9600.20821 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.5717 | 10.0.14393.5717 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.4010 | 10.0.17763.4010 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.1547 | 10.0.20348.1547 |
Detection & IOCsextracted from sources · hover to see the quote
- →The attack vector is network with no privileges required and no user interaction needed; target is the server account via a malicious network call to a Windows NPS (Network Policy Server) running PEAP ↗
- →PEAP is only negotiated when NPS is running on Windows Server with a network policy configured to allow PEAP; detection should focus on anomalous PEAP negotiation traffic toward NPS servers ↗
- →Exploitation assessed as 'More Likely' for latest software release despite no public exploit or in-the-wild exploitation at time of advisory; prioritize patching NPS servers exposed to network ↗
- ·To mitigate exposure, ensure PEAP Type is not configured as an allowed EAP type in NPS network policy; removing PEAP from allowed EAP types prevents the vulnerable code path from being reached ↗
- ·Vulnerability only exists on Windows Server instances where NPS is actively running and has a network policy permitting PEAP negotiation; servers without NPS or without PEAP-enabled policies are not exposed ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_msrc9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
vendor_msrc·2023-02-14·CVSS 9.8
CVE-2023-21689 [CRITICAL] CWE-122 Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
FAQ: According to the CVSS metric, the attack vector is network (AV:N), privilege required is none (PR:N), and user interaction is none (UI:N). What is the target used in the context of the remote code execution?
The attacker for this vulnerability could target the server accounts in an arbitrary or remote code execution and attempt to trigger malicious code in the context of the server's account through a network call. The attacker needs no privileges nor does the user need to perform any action.
Windows Protected EAP (PEAP): Windows Protected EAP (PEAP)
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Remote Code Execution
Exploit Status: Publicly Disclosed:No;Exploited:No;La
GHSA
GHSA-76p3-c44w-mmmj: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
ghsa_unreviewed·2023-02-14
CVE-2023-21689 [CRITICAL] GHSA-76p3-c44w-mmmj: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
No detection rules found.
No public exploits indexed.
Qualys
The February 2023 Patch Tuesday Security Update Review
blogs_qualys·2023-02-15
The February 2023 Patch Tuesday Security Update Review
## Table of Contents
Microsoft Patches for February2023
Adobe Patches for February2023
Notable and Critical Microsoft Vulnerabilities Patched
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
Qualys Monthly Webinar Series
This Month in Vulnerabilities & Patches
Microsoft and Adobe have released several monthly security fixes and updates for their products. Let’s take a look at the highlights of this month’s Patch Tuesday as we review and discuss the security updates.
## Microsoft Patches for February 2023
Microsoft has patched 79 vulnerabilities this month, in
Qualys
The February 2023 Patch Tuesday Security Update Review | Qualys
blogs_qualys·2023-02-15
The February 2023 Patch Tuesday Security Update Review | Qualys
#### Table of Contents
- Microsoft Patches for February2023
- Adobe Patches for February2023
- Notable and Critical Microsoft Vulnerabilities Patched
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- Qualys Monthly Webinar Series
- This Month in Vulnerabilities & Patches
Microsoft and Adobe have released several monthly security fixes and updates for their products. Let’s take a look at the highlights of this month’s Patch Tuesday as we review and discuss the security updates.
## Microsoft Patches for February 2023
Microsoft has patched 79 vulnerabilities t
Talos
Microsoft Patch Tuesday for February 2023 — Snort rules and prominent vulnerabilities
blogs_talos·2023-02-14·CVSS 9.8
CVE-2023-21823 [CRITICAL] Microsoft Patch Tuesday for February 2023 — Snort rules and prominent vulnerabilities
Microsoft released its monthly security update on Tuesday, disclosing 73 vulnerabilities. Of these vulnerabilities, 8 are classified as “Critical”, 64 are classified as “Important”, one vulnerability is classified as “Moderate.”
According to Microsoft none of the vulnerabilities has been publicly disclosed before Patch Tuesday and only three vulnerabilities were seen in the wild. The most serious one is CVE-2023-21823 a Windows Graphics Component Remote Code Execution Vulnerability. Followed by CVE-2023-21715 a Microsoft Publisher Security Features Bypass Vulnerability which we are describing below and CVE-2023-23376 a local Windows Common Log File System Driver Elevation of Privilege Vulnerability.
Three of the most “Critical“ vulnerabilities, which Microsoft considers to be “more likel
Tenable
Microsoft’s February 2023 Patch Tuesday Addresses 75 CVEs (CVE-2023-23376)
blogs_tenable·2023-02-14·CVSS 7.8
[HIGH] Microsoft’s February 2023 Patch Tuesday Addresses 75 CVEs (CVE-2023-23376)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Microsoft Patch Tuesday for February 2023 — Snort rules and prominent vulnerabilities
blogs_talos·2023-02-14·CVSS 9.8
[CRITICAL] Microsoft Patch Tuesday for February 2023 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for February 2023 — Snort rules and prominent vulnerabilities
Microsoft released its monthly security update on Tuesday, disclosing 73 vulnerabilities. Of these vulnerabilities, 8 are classified as “Critical”, 64 are classified as “Important”, one vulnerability is classified as “Moderate.”
According to Microsoft none of the vulnerabilities has been publicly disclosed before Patch Tuesday and only three vulnerabilities were seen in the wild. The most serious one is CVE-2023-21823 a Windows Graphics Component Remote Code Execution Vulnerability. Followed by CVE-2023-21715 a Microsoft Publisher Security Features Bypass Vulnerability which we are describing below and CVE-2023-23376 a local Windows Common Log File System Driver Elevation of Privilege Vulnerability.
Crowdstrike
February 2023 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] February 2023 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Crowdstrike
February 2023 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] February 2023 Patch Tuesday: Updates and Analysis
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
2023-02-14
Published