Actively exploited in the wild
Microsoft Windows Search Remote Code Execution Vulnerability
Microsoft — Windows · Listed in the CISA KEV since 2023-07-17. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-36884
HighCVSS 7.5KEVExploitation Probability (EPSS)
Very high risk100th percentile — higher than 100% of all known CVEs
Summary
A vulnerability in Windows Search allows for remote code execution. An attacker can exploit this flaw to gain control over the system.
Risk Assessment
This threat could lead to unauthorized access to data and full control over the compromised system. Organizations should be aware of the potential security implications.
Recommendation
It is recommended to update Windows to the latest version to patch this vulnerability. Additionally, systems should be monitored for suspicious activity.
Original NVD description (English source)
Windows Search Remote Code Execution Vulnerability