CVE-2023-28229

Deeper analysis

Windows CNG Key Isolation Service contains an elevation of privilege vulnerability tracked as CVE-2023-28229. The flaw resides in a core Windows cryptographic component responsible for isolating and managing keys, allowing an authenticated local user to obtain higher privileges on affected systems. The vulnerability carries a CVSS 3.1 score of 7.0 with a local attack vector, high complexity, and low privileges required.

An attacker with a local account can exploit the issue to escalate privileges, potentially gaining the ability to read, modify, or delete protected data and execute code with elevated rights. Exploitation requires no user interaction and targets the Windows kernel-adjacent service, enabling full compromise of confidentiality, integrity, and availability on the host.

Microsoft has published security updates addressing the flaw through its update guide, while CISA has added CVE-2023-28229 to its catalog of known exploited vulnerabilities, confirming active in-the-wild use and underscoring the need for prompt patching. Organizations should apply the relevant Windows security updates and verify service configurations to reduce exposure.

EPSS for this CVE rose materially from a low baseline to a peak of 0.4231 on 2024-08-15 before receding to the current 0.0864, indicating that exploitation interest increased well after initial disclosure and that the issue merits renewed attention.