Unpatched Office Remote Code Execution Vulnerability (CVE-2023-36884)

What is the Attack?




On June 11, 2023, Microsoft released an advisory and a blog for a new Office and Windows HTML Remote Code Execution (RCE) vulnerability that was reportedly leveraged by the Storm-0978 threat actor in attacks against defense and government agencies in Europe and North America. An attacker could exploit this vulnerability by tricking a user into opening a specially crafted Microsoft Office document. The vulnerability has a CVSS base score of 8.3 and is rated important by …

actor advisory america attack attacks blog code code execution cve cve-2023-36884 defense europe exploit government html june microsoft north north america office rce remote code remote code execution storm-0978 threat threat actor unpatched vulnerability what is windows