Cyber Resilience

CVE-2023-32046

HighCISA KEVActive ExploitationEUVD Exploited

Published: 11 July 2023

Published
11 July 2023
Modified
28 October 2025
KEV Added
11 July 2023
Patch
CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.4266 97.6th percentile
Risk Priority 61 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-32046 is a high-severity an unspecified weakness vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).

Operationally, ranked in the top 2.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).

Deeper analysis

CVE-2023-32046 is an elevation of privilege vulnerability in the Windows MSHTML Platform. It carries a CVSS 3.1 base score of 7.8 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and was published on 11 July 2023.

An attacker with the ability to run code on a local system can exploit the flaw by convincing a user to interact with specially crafted content, resulting in the attacker gaining elevated privileges equivalent to those of the targeted user account.

Microsoft has published remediation guidance through its Security Response Center update guide, and the vulnerability appears in the CISA Known Exploited Vulnerabilities catalog.

The associated EPSS score has remained steady at a peak of 0.4266 since disclosure, indicating sustained but not sharply increasing exploitation interest.

EU & UK References

Vulnerability details

Windows MSHTML Platform Elevation of Privilege Vulnerability

CWE(s)
KEV Date Added
11 July 2023

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

microsoft
windows 10 1507
≤ 10.0.10240.20048
microsoft
windows 10 1607
≤ 10.0.14393.6085
microsoft
windows 10 1809
≤ 10.0.17763.4645
microsoft
windows 10 21h2
≤ 10.0.19041.3208
microsoft
windows 10 22h2
≤ 10.0.19045.3208
microsoft
windows 11 21h2
≤ 10.0.22000.2176
microsoft
windows 11 22h2
≤ 10.0.22621.1992
microsoft
windows server 2008
all versions, r2
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
all versions
+2 more product configuration(s) — see NVD for full list

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires timely application of Microsoft security updates that remediate the MSHTML EoP flaw.

prevent

Malicious-code protections can block or sandbox crafted files or web content used to trigger the vulnerability.

prevent

Least-privilege execution limits the impact of successful local privilege escalation from the MSHTML flaw.

References