CVE-2023-36400
published 2023-11-14CVE-2023-36400: Windows HMAC Key Derivation Elevation of Privilege Vulnerability
high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
Windows HMAC Key Derivation Elevation of Privilege Vulnerability
Affected
33 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1507 | < 10.0.10240.20308 | 10.0.10240.20308 |
| microsoft | windows_10_1607 | < 10.0.14393.6452 | 10.0.14393.6452 |
| microsoft | windows_10_1809 | < 10.0.17763.5122 | 10.0.17763.5122 |
| microsoft | windows_10_21h2 | < 10.0.19041.3693 | 10.0.19041.3693 |
| microsoft | windows_10_22h2 | < 10.0.19045.3693 | 10.0.19045.3693 |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.20308 | 10.0.10240.20308 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.6452 | 10.0.14393.6452 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.5122 | 10.0.17763.5122 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.5122 | 10.0.17763.5122 |
| microsoft | windows_10_version_21h2 | >= 10.0.19043.0 < 10.0.19043.3693 | 10.0.19043.3693 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.3693 | 10.0.19045.3693 |
| microsoft | windows_11_21h2 | < 10.0.22000.2600 | 10.0.22000.2600 |
| microsoft | windows_11_22h2 | < 10.0.22621.2715 | 10.0.22621.2715 |
| microsoft | windows_11_23h2 | < 10.0.22621.2715 | 10.0.22621.2715 |
| microsoft | windows_11_version_21h2 | >= 10.0.0 < 10.0.22000.2600 | 10.0.22000.2600 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.2715 | 10.0.22621.2715 |
| microsoft | windows_11_version_22h3 | >= 10.0.22631.0 < 10.0.22631.2715 | 10.0.22631.2715 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.2715 | 10.0.22631.2715 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.6452 | 10.0.14393.6452 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.5122 | 10.0.17763.5122 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.2113 | 10.0.20348.2113 |
| msrc | windows_10 | — | — |
| msrc | windows_10_version_1607 | — | — |
| msrc | windows_10_version_1809 | — | — |
| msrc | windows_10_version_21h2 | — | — |
Microsoft
Windows HMAC Key Derivation Elevation of Privilege Vulnerability
vendor_msrc·2023-11-14·CVSS 8.8
CVE-2023-36400 [HIGH] CWE-122 Windows HMAC Key Derivation Elevation of Privilege Vulnerability
Windows HMAC Key Derivation Elevation of Privilege Vulnerability
FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
FAQ: How could an attacker exploit this vulnerability?
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.
FAQ: According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
In this case, a successful attack could be performed from a low privilege Hyper-V guest. The attacker could traverse the guest's
GHSA
GHSA-m23j-24cg-vhc8: Windows HMAC Key Derivation Elevation of Privilege Vulnerability
ghsa_unreviewed·2023-11-14
CVE-2023-36400 [HIGH] GHSA-m23j-24cg-vhc8: Windows HMAC Key Derivation Elevation of Privilege Vulnerability
Windows HMAC Key Derivation Elevation of Privilege Vulnerability
No detection rules found.
No public exploits indexed.
Checkpoint
20th November – Threat Intelligence Report
blogs_checkpoint·2023-11-20·CVSS 7.8
CVE-2023-38831 [HIGH] 20th November – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 20th November – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 20th November, please download our Threat_Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Russia-affiliated military intelligence group SandWorm is reportedly responsible for an attack against 22 critical infrastructure companies in Denmark. The attacks, most severe in Danish history, have compromised industrial control systems and forced companies from the energy sector to work offline.
Medusa ransomware g
Trendmicro
The November 2023 Security Update Review
blogs_trendmicro·2023-11-14·CVSS 8.8
[HIGH] The November 2023 Security Update Review
## The November 2023 Security Update Review
Get the November 2023 security update and review.
By: Zero Day Initiative 2023/11/14 Read time: ( words)
Save to Folio
It’s the penultimate second Tuesday of 2023, and Microsoft and Adobe have released their latest security patches into the crisp, fall air. Take a break from your scheduled activities and join us as we review the details of their latest advisories. If you’d rather watch the video recap, you can check it out here:
C VE
Title
Severity
CVSS
Public
Exploited
Type
CVE-2023-36033
Windows DWM Core Library Elevation of Privilege Vulnerability
Important
7.8
Yes
Yes
EoP
CVE-2023-36036
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Important
7.8
No
Yes
EoP
CVE-2023-36025
Windows SmartSc
Bleepingcomputer
Microsoft November 2023 Patch Tuesday fixes 5 zero-days, 58 flaws
blogs_bleepingcomputer·2023-11-14·CVSS 7.8
[HIGH] Microsoft November 2023 Patch Tuesday fixes 5 zero-days, 58 flaws
## Microsoft November 2023 Patch Tuesday fixes 5 zero-days, 58 flaws
## Lawrence Abrams
16 Elevation of Privilege Vulnerabilities
6 Security Feature Bypass Vulnerabilities
15 Remote Code Execution Vulnerabilities
6 Information Disclosure Vulnerabilities
5 Denial of Service Vulnerabilities
11 Spoofing Vulnerabilities
The total count of 58 flaws does not include 5 Mariner security updates and 20 Microsoft Edge security updates released earlier this month.
To learn more about the non-security updates released today, you can review our dedicated articles on the new Windows 11 KB5032190 cumulative update and Windows 10 KB5032189 cumulative update .
## Five zero-days fixed
This month's Patch Tuesday fixes five zero-day vulnerabilities, with three exploited in attacks and three publicl
Trendmicro
The November 2023 Security Update Review
blogs_trendmicro·2023-11-14
The November 2023 Security Update Review
# The November 2023 Security Update Review
Get the November 2023 security update and review.
By: Zero Day Initiative
2023/11/14
Read time: ( words)
Save to Folio
It’s the penultimate second Tuesday of 2023, and Microsoft and Adobe have released their latest security patches into the crisp, fall air. Take a break from your scheduled activities and join us as we review the details of their latest advisories. If you’d rather watch the video recap, you can check it out here:
Adobe Patches for November 2023
For November, Adobe released 14 bulletins addressing 76 CVEs in Adobe Acrobat and Reader, ColdFusion, Audition, Premiere Pro, After Effects, Media Encoder, Dimension, Animate, InCopy, InDesign, RoboHelp, FrameMaker Publishing Server, Bridge, and Photoshop. A total of 54 of these bugs
Qualys
November 2023 Patch Tuesday: MS and Adobe Remediation | Qualys
blogs_qualys·2023-11-14
November 2023 Patch Tuesday: MS and Adobe Remediation | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for November 2023
- Adobe Patches for November 2023
- Zero-day Vulnerabilities Patched in November Patch Tuesday Edition
- Other Critical Severity Vulnerabilities Patched in November Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response(VMDR)
- Rapid Response with Patch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
- Qualys Monthly Webinar Series
Microsoft released its second last Patch Tuesday edition of the year. We invite you to join us to review and discuss the details of these security updates and
Qualys
Microsoft and Adobe Patch Tuesday, November 2023 Security Update Review
blogs_qualys·2023-11-14
Microsoft and Adobe Patch Tuesday, November 2023 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for November 2023
Adobe Patches for November 2023
Zero-day Vulnerabilities Patched in November Patch Tuesday Edition
Other Critical Severity Vulnerabilities Patched in November Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response(VMDR)
Rapid Response with Patch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
Qualys Monthly Webinar Series
Microsoft released its second last Patch Tuesday edition of the year. We invite you to join us to review and discuss the details of these security updates and patches.
## M
Trendmicro
The November 2023 Security Update Review
blogs_trendmicro·2023-11-14·CVSS 8.8
[HIGH] The November 2023 Security Update Review
## The November 2023 Security Update Review
Get the November 2023 security update and review.
By: Zero Day Initiative Nov 14, 2023 Read time: ( words)
Save to Folio
It’s the penultimate second Tuesday of 2023, and Microsoft and Adobe have released their latest security patches into the crisp, fall air. Take a break from your scheduled activities and join us as we review the details of their latest advisories. If you’d rather watch the video recap, you can check it out here:
C VE
Title
Severity
CVSS
Public
Exploited
Type
CVE-2023-36033
Windows DWM Core Library Elevation of Privilege Vulnerability
Important
7.8
Yes
Yes
EoP
CVE-2023-36036
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Important
7.8
No
Yes
EoP
CVE-2023-36025
Windows Smart
Crowdstrike
November Patch Tuesday 2023: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] November Patch Tuesday 2023: Updates and Analysis
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
2023-11-14
Published