CVE-2023-36884 | Netskope Threat Labs

Description

This detection identifies exploitation attempts targeting CVE-2023-36884, which has a HIGH severity rating. Microsoft's advisory names this issue the Windows Search Remote Code Execution Vulnerability, a flaw reachable through specially crafted Microsoft Office documents that lets cyberattackers execute code in the context of the logged on user.

Stats

First seen: July 2023
Last seen: September 2026

CVEs

CVE-2023-36884

Alert name variants

Alert Name	Engine
Document-HTML.Exploit.CVE-2023-36884	ATP Sandbox Adv. Heuristics
Document-Word.Exploit.CVE-2023-36884	ATP Sandbox Adv. Heuristics
Email-MIME.Exploit.CVE-2023-36884	ATP Sandbox Adv. Heuristics
Script.Exploit.CVE-2023-36884	ATP Sandbox Adv. Heuristics
Shortcut.Exploit.CVE-2023-36884	ATP Sandbox Adv. Heuristics
Win32.Exploit.CVE-2023-36884	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
FILE-OFFICE Microsoft Office HTML remote code execution attempt	IPS-SWG
FILE-OFFICE Microsoft Office RTF object remote code execution attempt	IPS-SWG

Related blogs

Netskope Threat Coverage: Microsoft Office and Windows Zero Day (CVE-2023-36884)

July 20, 20231 min read

Related families

Microsoft

References

nvd.nist.gov