CVE-2023-36397
published 2023-11-14CVE-2023-36397: Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
PriorityP272critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
17.51%
96.8th percentile
Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
Affected
43 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1507 | < 10.0.10240.20308 | 10.0.10240.20308 |
| microsoft | windows_10_1607 | < 10.0.14393.6452 | 10.0.14393.6452 |
| microsoft | windows_10_1809 | < 10.0.17763.5122 | 10.0.17763.5122 |
| microsoft | windows_10_21h2 | < 10.0.19041.3693 | 10.0.19041.3693 |
| microsoft | windows_10_22h2 | < 10.0.19045.3693 | 10.0.19045.3693 |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.20308 | 10.0.10240.20308 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.6452 | 10.0.14393.6452 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.5122 | 10.0.17763.5122 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.5122 | 10.0.17763.5122 |
| microsoft | windows_10_version_21h2 | >= 10.0.19043.0 < 10.0.19043.3693 | 10.0.19043.3693 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.3693 | 10.0.19045.3693 |
| microsoft | windows_11_21h2 | < 10.0.22000.2600 | 10.0.22000.2600 |
| microsoft | windows_11_22h2 | < 10.0.22621.2715 | 10.0.22621.2715 |
| microsoft | windows_11_23h2 | < 10.0.22621.2715 | 10.0.22621.2715 |
| microsoft | windows_11_version_21h2 | >= 10.0.0 < 10.0.22000.2600 | 10.0.22000.2600 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.2715 | 10.0.22621.2715 |
| microsoft | windows_11_version_22h3 | >= 10.0.22631.0 < 10.0.22631.2715 | 10.0.22631.2715 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.2715 | 10.0.22631.2715 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.26816 | 6.1.7601.26816 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.22367 | 6.0.6003.22367 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.24569 | 6.2.9200.24569 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.21668 | 6.3.9600.21668 |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
62627
snort↗
62628
snort↗
62630
snort↗
62631
snort↗
62632
snort↗
62633
snort↗
62641
snort↗
62642
snort↗
62643
snort↗
62644
snort↗
300751
snort↗
300752
snort↗
300753
snort↗
300757
snort↗
300758
- →Check for the Windows Message Queuing service running and TCP port 1801 actively listening — both conditions must be true for a host to be exploitable. ↗
- →Exploitation requires the Windows Message Queuing (MSMQ) service to be enabled; hunt for unexpected enablement of this service on internet-facing or PGM Server hosts. ↗
- →Trigger condition is a specially crafted file sent over the network to a PGM Server environment with MSMQ running; monitor for anomalous inbound network traffic to TCP/1801 from untrusted sources. ↗
- ·The Talos Snort rule set covers multiple November 2023 Patch Tuesday CVEs, not exclusively CVE-2023-36397; confirm which specific rule IDs map to this CVE before deploying. ↗
- ·Microsoft rates exploitation of CVE-2023-36397 as 'Less Likely' and it has not been publicly disclosed or exploited in the wild as of the advisory date. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_msrc9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
vendor_msrc·2023-11-14·CVSS 9.8
CVE-2023-36397 [CRITICAL] CWE-126 Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
FAQ: How could an attacker exploit this vulnerability?
When Windows message queuing service is running in a PGM Server environment, an attacker could send a specially crafted file over the network to achieve remote code execution and attempt to trigger malicious code.
Windows Internet Connection Sharing (ICS): Windows Internet Connection Sharing (ICS)
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Remote Code Execution
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5032196
Reference: https://support.microsoft.com/help/5032196
Reference: https://catalog.update.microsoft.
GHSA
GHSA-fvxr-6v23-vmqv: Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
ghsa_unreviewed·2023-11-14
CVE-2023-36397 [CRITICAL] GHSA-fvxr-6v23-vmqv: Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
No detection rules found.
No public exploits indexed.
Checkpoint
20th November – Threat Intelligence Report
blogs_checkpoint·2023-11-20·CVSS 7.8
CVE-2023-38831 [HIGH] 20th November – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 20th November – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 20th November, please download our Threat_Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Russia-affiliated military intelligence group SandWorm is reportedly responsible for an attack against 22 critical infrastructure companies in Denmark. The attacks, most severe in Danish history, have compromised industrial control systems and forced companies from the energy sector to work offline.
Medusa ransomware g
Trendmicro
The November 2023 Security Update Review
blogs_trendmicro·2023-11-14·CVSS 8.8
[HIGH] The November 2023 Security Update Review
## The November 2023 Security Update Review
Get the November 2023 security update and review.
By: Zero Day Initiative 2023/11/14 Read time: ( words)
Save to Folio
It’s the penultimate second Tuesday of 2023, and Microsoft and Adobe have released their latest security patches into the crisp, fall air. Take a break from your scheduled activities and join us as we review the details of their latest advisories. If you’d rather watch the video recap, you can check it out here:
C VE
Title
Severity
CVSS
Public
Exploited
Type
CVE-2023-36033
Windows DWM Core Library Elevation of Privilege Vulnerability
Important
7.8
Yes
Yes
EoP
CVE-2023-36036
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Important
7.8
No
Yes
EoP
CVE-2023-36025
Windows SmartSc
Talos
Microsoft discloses only three critical vulnerabilities in November’s Patch Tuesday update, three other zero-days
blogs_talos·2023-11-14·CVSS 8.8
[HIGH] Microsoft discloses only three critical vulnerabilities in November’s Patch Tuesday update, three other zero-days
Microsoft’s monthly security update released Tuesday only includes three critical vulnerabilities, an unusually small number based on previous months’ Patch Tuesdays.
In all, this set of vulnerabilities Microsoft patched includes 57 vulnerabilities, 54 of which are considered “important.” This is the fewest number of vulnerabilities Microsoft disclosed in a month since May.
However, there are three zero-day vulnerabilities included in November’s Patch Tuesday, and another three that have already been publicly disclosed.
CVE-2023-36033 is an elevation of privilege vulnerability in the Windows DWM Core Library that could allow an attacker to gain SYSTEM-level privileges. According to Microsoft, this vulnerability has already been exploited in the wild and there is proof-of-concept code av
Bleepingcomputer
Microsoft November 2023 Patch Tuesday fixes 5 zero-days, 58 flaws
blogs_bleepingcomputer·2023-11-14·CVSS 7.8
[HIGH] Microsoft November 2023 Patch Tuesday fixes 5 zero-days, 58 flaws
## Microsoft November 2023 Patch Tuesday fixes 5 zero-days, 58 flaws
## Lawrence Abrams
16 Elevation of Privilege Vulnerabilities
6 Security Feature Bypass Vulnerabilities
15 Remote Code Execution Vulnerabilities
6 Information Disclosure Vulnerabilities
5 Denial of Service Vulnerabilities
11 Spoofing Vulnerabilities
The total count of 58 flaws does not include 5 Mariner security updates and 20 Microsoft Edge security updates released earlier this month.
To learn more about the non-security updates released today, you can review our dedicated articles on the new Windows 11 KB5032190 cumulative update and Windows 10 KB5032189 cumulative update .
## Five zero-days fixed
This month's Patch Tuesday fixes five zero-day vulnerabilities, with three exploited in attacks and three publicl
Trendmicro
The November 2023 Security Update Review
blogs_trendmicro·2023-11-14
The November 2023 Security Update Review
# The November 2023 Security Update Review
Get the November 2023 security update and review.
By: Zero Day Initiative
2023/11/14
Read time: ( words)
Save to Folio
It’s the penultimate second Tuesday of 2023, and Microsoft and Adobe have released their latest security patches into the crisp, fall air. Take a break from your scheduled activities and join us as we review the details of their latest advisories. If you’d rather watch the video recap, you can check it out here:
Adobe Patches for November 2023
For November, Adobe released 14 bulletins addressing 76 CVEs in Adobe Acrobat and Reader, ColdFusion, Audition, Premiere Pro, After Effects, Media Encoder, Dimension, Animate, InCopy, InDesign, RoboHelp, FrameMaker Publishing Server, Bridge, and Photoshop. A total of 54 of these bugs
Qualys
November 2023 Patch Tuesday: MS and Adobe Remediation | Qualys
blogs_qualys·2023-11-14
November 2023 Patch Tuesday: MS and Adobe Remediation | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for November 2023
- Adobe Patches for November 2023
- Zero-day Vulnerabilities Patched in November Patch Tuesday Edition
- Other Critical Severity Vulnerabilities Patched in November Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response(VMDR)
- Rapid Response with Patch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
- Qualys Monthly Webinar Series
Microsoft released its second last Patch Tuesday edition of the year. We invite you to join us to review and discuss the details of these security updates and
Talos
Microsoft discloses only three critical vulnerabilities in November’s Patch Tuesday update, three other zero-days
blogs_talos·2023-11-14·CVSS 8.8
[HIGH] Microsoft discloses only three critical vulnerabilities in November’s Patch Tuesday update, three other zero-days
## Microsoft discloses only three critical vulnerabilities in November’s Patch Tuesday update, three other zero-days
Microsoft’s monthly security update released Tuesday only includes three critical vulnerabilities, an unusually small number based on previous months’ Patch Tuesdays .
In all, this set of vulnerabilities Microsoft patched includes 57 vulnerabilities, 54 of which are considered “important.” This is the fewest number of vulnerabilities Microsoft disclosed in a month since May.
However, there are three zero-day vulnerabilities included in November’s Patch Tuesday, and another three that have already been publicly disclosed.
CVE-2023-36033 is an elevation of privilege vulnerability in the Windows DWM Core Library that could allow an attacker to gain SYSTEM-level privileges.
Qualys
Microsoft and Adobe Patch Tuesday, November 2023 Security Update Review
blogs_qualys·2023-11-14
Microsoft and Adobe Patch Tuesday, November 2023 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for November 2023
Adobe Patches for November 2023
Zero-day Vulnerabilities Patched in November Patch Tuesday Edition
Other Critical Severity Vulnerabilities Patched in November Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response(VMDR)
Rapid Response with Patch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
Qualys Monthly Webinar Series
Microsoft released its second last Patch Tuesday edition of the year. We invite you to join us to review and discuss the details of these security updates and patches.
## M
Trendmicro
The November 2023 Security Update Review
blogs_trendmicro·2023-11-14·CVSS 8.8
[HIGH] The November 2023 Security Update Review
## The November 2023 Security Update Review
Get the November 2023 security update and review.
By: Zero Day Initiative Nov 14, 2023 Read time: ( words)
Save to Folio
It’s the penultimate second Tuesday of 2023, and Microsoft and Adobe have released their latest security patches into the crisp, fall air. Take a break from your scheduled activities and join us as we review the details of their latest advisories. If you’d rather watch the video recap, you can check it out here:
C VE
Title
Severity
CVSS
Public
Exploited
Type
CVE-2023-36033
Windows DWM Core Library Elevation of Privilege Vulnerability
Important
7.8
Yes
Yes
EoP
CVE-2023-36036
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Important
7.8
No
Yes
EoP
CVE-2023-36025
Windows Smart
Crowdstrike
November Patch Tuesday 2023: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] November Patch Tuesday 2023: Updates and Analysis
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
2023-11-14
Published