CVE-2023-36028

Deeper analysis

Microsoft Protected Extensible Authentication Protocol (PEAP) contains a remote code execution vulnerability tracked as CVE-2023-36028. The flaw, assigned CWE-122, affects the PEAP implementation in Microsoft networking components and carries a CVSS 3.1 score of 9.8, reflecting network-accessible attack conditions with no required authentication or user interaction.

An unauthenticated attacker positioned on the network can send specially crafted PEAP messages to trigger the flaw, resulting in arbitrary code execution with the privileges of the affected process. Successful exploitation grants full control over the target system, including the ability to install programs, view or modify data, and create new accounts.

Microsoft’s advisory at the referenced MSRC update guide directs administrators to apply the security updates released for affected Windows versions and related components; the guidance also covers configuration options that can reduce exposure until patches are deployed.

EPSS for the CVE rose sharply from a low baseline to a peak of 0.4006 on 2025-01-22 before receding to the current value of 0.0054, indicating a period of increased exploitation interest well after initial disclosure.