Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

CVE-2023-36884 - Microsoft Office and Windows HTML Remote Code Execution: Threat Brief (Updated)

Summary: Microsoft disclosed CVE-2023-36884, an Office and Windows HTML remote code execution vulnerability it rated "important" severity, with active in-the-wild exploitation via specially crafted Office documents that requires the user to open the file. Unit 42 confirmed exploitation since at least July 3, 2023, with early attacks using the RomCom malware, a RAT reported by Microsoft on July 11, 2023, and Microsoft released a patch for Office in August 2023.

What's compelling: Exploitation traces back to at least July 3, 2023, and the RomCom malware behind early attacks is a low-volume family previously seen in both ransomware and targeted espionage operations - so the same document-opening habit that enables this bug has already been a path to two very different kinds of damage.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Vulnerabilities & Patching
Mentions
CVE-2023-36884
Related