Microsoft Patch Tuesday, February 2023 Edition
Summary: Microsoft's February 2023 Patch Tuesday fixed three zero-day vulnerabilities under active attack: CVE-2023-23376, an elevation of privilege flaw in the Windows Common Log File System Driver that lets an attacker run code as SYSTEM; CVE-2023-21715, a Microsoft Office security feature bypass; and CVE-2023-21823, an elevation of privilege bug in the Windows Graphic component that names OneNote as a vulnerable component. Microsoft also patched CVE-2023-21716, a Word remote code execution flaw with a CVSS score of 9.8 that can be triggered by viewing a booby-trapped document in the Outlook preview pane, and three Exchange Server remote code execution flaws (CVE-2023-21706, CVE-2023-21707, CVE-2023-21529).
Key Takeaway: Three of these flaws were already being exploited before a patch existed, and the Word bug carries a 9.8 severity score while triggering on nothing more than an Outlook preview - so the gap between patch release and deployment is exposure time, not maintenance time.