---
title: "Windows CNG Key Isolation CVE-2023-28229: Exploited EoP"
url: https://erroneo.us/security/briefs/windows-cng-key-isolation-cve-2023-28229-eop/
description: "An April 2023 Windows privilege escalation in the CNG Key Isolation service joined CISA KEV in Oct 2023. Hosts patched since then are safe; find stragglers."
type: security-brief
section: "Security Digest"
date_published: 2023-04-11
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-28229"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Windows CNG Key Isolation CVE-2023-28229: Exploited EoP

**Verdict: Check exposure.** Fixed in April 2023 and listed as exploited since October 2023, this local bug only matters on Windows hosts that stopped taking updates in early 2023; find those and patch or retire them.

- **Who must act:** Owners of Windows clients or servers below the April 2023 fixed builds, such as out-of-support servers, Windows-based appliances and never-refreshed images.
- **Who can relax:** Anyone whose Windows fleet has installed any monthly cumulative update or Monthly Rollup from April 2023 onward; the bug also needs local code execution first.
- **Affected:** Windows 10 1507, 1607, 1809, 20H2, 21H2 and 22H2 before the April 2023 builds; Windows 11 21H2 and 22H2 before the April 2023 builds; Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019 and 2022 before the April 2023 builds
- **Fixed:** Windows 10 22H2 10.0.19045.2846 (KB5025221); Windows 11 22H2 10.0.22621.1555 (KB5025239); Windows Server 2019 / Windows 10 1809 10.0.17763.4252 (KB5025229); Windows Server 2022 10.0.20348.1668 (KB5025230); Windows Server 2016 / Windows 10 1607 10.0.14393.5850 (KB5025228); Windows Server 2012 R2 6.3.9600.20919 (Monthly Rollup KB5025285 or Security Only KB5025288)
- **CVEs:** CVE-2023-28229
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Pull OS build and UBR numbers for every Windows host from your management tool and compare them with the April 2023 fixed builds.
2. Install the current cumulative update on anything below those builds, which also covers the related leak CVE-2023-36906 and later fixes.
3. On Server 2008 through 2012 R2 hosts that took Security Only packages, confirm the April 2023 package or a later Monthly Rollup is present.
4. Retire or isolate Windows hosts that can no longer be patched.
5. On any host that was below the fixed build while users or services could run code on it, run the hunt below.

### How to check if you are affected

- Run Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select ProductName, CurrentBuild, UBR and compare with the fixed builds.
- Run Get-HotFix | Sort-Object InstalledOn on older servers and look for KB5025285, KB5025288 or a later rollup.
- In EDR data, look for low-privileged processes that suddenly gained SYSTEM-level children, new services or scheduled tasks on hosts that were unpatched in 2023.
- Review crash reports involving lsass.exe, which hosts the Key Isolation service, on unpatched hosts.

## What happened

On April 11, 2023, Microsoft's monthly updates fixed CVE-2023-28229, a privilege escalation bug in the Windows CNG Key Isolation Service. The [Microsoft advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28229) rates it Important, with a CVSS 3.1 score of 7.0, and credits k0shl of Kunlun Lab. Its FAQ says an attacker must "win a race condition." Success yields "specific limited SYSTEM privileges." The attacker must already run code as a low-privileged user, so this is a second stage, not a way in.

[0patch](https://0patch.com/blog/micropatches-released-for-two-windows) explains the root cause. The Key Isolation service runs inside `lsass.exe`. Flawed locking left reference-count updates unprotected, so one thread could free a key structure while another still used it. A proof of concept appeared on [GitHub](https://github.com/Y3A/CVE-2023-28229) in September 2023. Its README calls it "Windows CNG KeyIso RPC EoP/SBX," which suggests both privilege escalation and sandbox escape, and credits discovery to k0shl. The PoC also uses [CVE-2023-36906](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36906), an information leak in the same service that Microsoft fixed in August 2023. 0patch says the leak makes the exploit more reliable.

On October 4, 2023, CISA [added](https://www.cisa.gov/news-events/alerts/2023/10/04/cisa-adds-two-known-exploited-vulnerabilities-catalog-removes-five-kevs) the bug to its [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28229) "based on evidence of active exploitation." [The Hacker News](https://thehackernews.com/2023/10/cisa-warns-of-active-exploitation-of.html) noted that there were "no public reports documenting in-the-wild exploitation." That gap remains. As of Oct 23, 2026, no public report names who used the bug or against whom, and KEV lists ransomware use as unknown. Microsoft's guide still says "Exploited: No" and "Exploitation Less Likely."

## Who is affected

According to the [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-28229) and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-28229), the bug affects every Windows release Microsoft supported at the time. That covers Windows 10 1507 through 22H2, Windows 11 21H2 and 22H2, and Windows Server 2008 SP2 through 2022. Fixed builds include 10.0.19045.2846 for Windows 10 22H2, 10.0.22621.1555 for Windows 11 22H2, 10.0.17763.4252 for Server 2019 and 10.0.20348.1668 for Server 2022.

## Do you really need to act?

Probably not, if your Windows patching works. The CVE record lists a fixed build for each version, so a host at or above that build is covered. Older servers got the fix in both the Monthly Rollup and the Security Only package. The real risk is a host that stopped patching in early 2023, such as an out-of-support server, a Windows-based appliance, or a golden image that never gets refreshed. On such a machine this is one bug among many. With public exploit code, any foothold, like a phished user or a hijacked service account, can become SYSTEM. So the verdict is to check exposure and find the stragglers.

## What to do now

1. Pull build numbers from your management tool, or run `Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select ProductName, CurrentBuild, UBR`. Compare the build and UBR with the fixed builds.
2. Install the current cumulative update on anything below them, not the April 2023 package. That also covers CVE-2023-36906 and later fixes.
3. On Server 2008 through 2012 R2, run `Get-HotFix | Sort-Object InstalledOn`. Confirm the April 2023 package, for example KB5025288 (Security Only) or KB5025285 (Monthly Rollup) on 2012 R2, or a later rollup.
4. Retire or isolate hosts that can no longer be patched.

## How to tell if you were hit

Neither CISA nor Microsoft has published indicators for this CVE. Fold it into a wider hunt on hosts that sat below the fixed builds while users or services could run code on them. In EDR data, look for low-privileged processes that suddenly spawned SYSTEM-level children, and for new services or scheduled tasks created around the same time. The bug lives in `lsass.exe`, so also review crash reports involving that process.

## Timeline

- Apr 11, 2023 — Microsoft fixes CVE-2023-28229 in its April updates.
- Aug 8, 2023 — Microsoft fixes the related leak, CVE-2023-36906.
- Sep 2023 — A public proof of concept appears on GitHub.
- Oct 4, 2023 — CISA adds CVE-2023-28229 to KEV.
- Oct 9, 2023 — 0patch ships micropatches for both bugs.
- Oct 25, 2023 — Federal remediation deadline.

## Sources

1. [Microsoft — Security Update Guide: CVE-2023-28229, Windows CNG Key Isolation Service Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28229)
2. [Microsoft — Security Update Guide: CVE-2023-36906, Windows Cryptographic Services Information Disclosure Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36906)
3. [CVE record — CVE-2023-28229](https://www.cve.org/CVERecord?id=CVE-2023-28229)
4. [NVD — CVE-2023-28229](https://nvd.nist.gov/vuln/detail/CVE-2023-28229)
5. [CISA — Known Exploited Vulnerabilities: CVE-2023-28229](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28229)
6. [CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog, Removes Five KEVs (Oct 4, 2023)](https://www.cisa.gov/news-events/alerts/2023/10/04/cisa-adds-two-known-exploited-vulnerabilities-catalog-removes-five-kevs)
7. [Y3A on GitHub — CVE-2023-28229 proof of concept (discovered by k0shl)](https://github.com/Y3A/CVE-2023-28229)
8. [0patch — Micropatches Released For Two Windows CNG Key Isolation Service Vulnerabilities (CVE-2023-28229, CVE-2023-36906)](https://0patch.com/blog/micropatches-released-for-two-windows)
9. [The Hacker News — CISA Warns of Active Exploitation of JetBrains and Windows Vulnerabilities](https://thehackernews.com/2023/10/cisa-warns-of-active-exploitation-of.html)

---
Source page: https://erroneo.us/security/briefs/windows-cng-key-isolation-cve-2023-28229-eop/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt