CVE-2023-21549
Access Control in Microsoft Windows 10 1809
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-21549 is a high-severity Improper Authorization (CWE-285) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 27% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-21549 is an elevation-of-privilege vulnerability in the Windows SMB Witness Service. The flaw is tracked under CWE-285 and CWE-269 and carries a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, and low privileges required. It affects supported Windows releases that implement the SMB Witness Service for failover clustering and continuous availability.
An authenticated attacker with low-privileged network access can exploit the issue to obtain SYSTEM-level privileges on the target host, resulting in full control over confidentiality, integrity, and availability without user interaction. The attack can be launched remotely against any reachable SMB Witness endpoint that accepts the attacker’s credentials.
Microsoft’s security update guide for CVE-2023-21549 lists the corresponding monthly security updates that address the vulnerability; administrators are advised to apply the patches for the affected Windows versions. The EPSS score has remained flat at 0.0906 since disclosure, indicating no material increase in observed exploitation interest.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-25716
Vulnerability Data
Windows SMB Witness Service Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Documented procedures facilitate correct implementation and ongoing management of authorization decisions.
Periodic reviews identify and correct flaws in authorization decisions or enforcement.
Specifying access authorizations for each account and requiring approvals for account requests enforces proper authorization decisions.
Ensures authorization decisions are always performed by a complete and analyzable reference monitor.
By mandating division of duties across roles, the control enforces proper privilege management and prevents a single entity from controlling an entire sensitive process.
Implements core proper privilege management by restricting to only required rights.
Training covers proper privilege management practices, making incorrect privilege assignments less likely.
Review helps detect improper privilege management by flagging unauthorized privilege changes or uses.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.1 only requires the existence of an overarching policy and topic-specific policies (including on access control); it does not itself perform or enforce any authorization check, so the CWE-285 weakness can still be exploited.
Mapping access rights to information classification and business requirements forces correct enforcement of authorization decisions, blocking the incorrect authorization weakness at the policy and implementation stage.
A.5.18 directly governs the provisioning, review, modification and timely revocation of access rights (including for role changes, termination and privilege levels), which stops most improper privilege spheres from being exploitable even if the assignment flaw exists; the bounded remainder is flaws in the underlying enforcement mechanism itself (e.g. AC-3/A.8.3)
Defining and communicating authorization levels for each role limits the assignment of excessive or unnecessary privileges.
Independent reviewers evaluate whether authorization logic matches policy, thereby reducing the window in which incorrect or missing authorization checks remain in production.
By requiring managers to verify that authorization decisions match policy and to remediate deviations, the control limits the persistence of incorrect or missing authorization checks.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.