November 2023

November 2023 Patch Tuesday was relatively light on vulnerabilities but still shipped one zero-day, which Kikta treats as a reason for more suspicion heading into the holidays.

CVE-2023-36025 is the SmartScreen security feature bypass to patch first. It sits on the CISA Known Exploited Vulnerabilities catalog, meaning CISA confirmed active exploitation in the wild, and the pattern points to a likely state-sponsored actor.

Kikta traces the SmartScreen problem to transitory trust assumptions. EV code-signing certificates once let binaries skip the reputation check. As certificate authorities watered down EV standards to keep issuing at scale, that long-standing bypass never got revisited.

CVE-2023-36400 is a Hyper-V guest-to-host breakout. A low-privileged guest can break the virtual machine boundary and run code on the host as SYSTEM, skipping the hardened privilege-escalation path entirely.

CVE-2023-36422 is a Windows Defender privilege escalation rated CVSS 7.8 with a local vector, low complexity, low privileges required, and no user interaction. Defender's constant file parsing is the likely exploit path, and you cannot simply remove Defender from your endpoints.