Windows CNG Key Isolation CVE-2023-28229: Exploited EoP
Fixed in April 2023 and listed as exploited since October 2023, this local bug only matters on Windows hosts that stopped taking updates in early 2023; find those and patch or retire them.
Must act: Owners of Windows clients or servers below the April 2023 fixed builds, such as out-of-support servers, Windows-based appliances and never-refreshed images.
Can relax: Anyone whose Windows fleet has installed any monthly cumulative update or Monthly Rollup from April 2023 onward; the bug also needs local code execution first.
- Pull OS build and UBR numbers for every Windows host from your management tool and compare them with the April 2023 fixed builds.
- Install the current cumulative update on anything below those builds, which also covers the related leak CVE-2023-36906 and later fixes.
- On Server 2008 through 2012 R2 hosts that took Security Only packages, confirm the April 2023 package or a later Monthly Rollup is present.