Security readout for executives and security teams
Plain-English summary
CVE-2023-35360 is a Microsoft Windows kernel elevation-of-privilege flaw. An attacker who already has low-privileged local access could potentially gain high system-level privileges. This is mainly a post-compromise risk: it can turn a limited foothold on a Windows endpoint or server into broader control.
Executive priority
High priority for normal patch governance. This is not presented as actively exploited in the provided sources, but successful abuse could give an attacker full control after gaining local access. Remediate promptly, with extra focus on high-value Windows servers and shared systems.
Technical view
The CVSS 3.1 vector is AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, scoring 7.0. Affected platforms include multiple Windows 10, Windows 11, Windows Server 2012/2012 R2/2016/2019/2022, and Server Core variants. The source bundle maps the issue to CWE-591 and Microsoft lists official remediation.
Likely exposure
Organizations running the listed Windows desktop or server versions are potentially exposed until the relevant Microsoft update is applied. Exposure is highest on shared workstations, servers allowing interactive logon, VDI, jump hosts, and systems where a low-privileged account compromise is plausible.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Exploitation requires local access and low privileges, with high attack complexity and no user interaction. Treat it as a privilege-escalation link in a broader intrusion chain, not an internet-facing initial access bug.
Researcher notes
The public bundle provides severity, affected products, CVSS, CWE-591, and MSRC remediation reference, but not root-cause detail or exploit mechanics. Avoid assuming exploit availability. Validation should focus on Microsoft update applicability and asset exposure rather than reproducing exploitation.
Mitigation direction
- Apply the Microsoft security update for CVE-2023-35360 from the MSRC advisory.
- Prioritize shared endpoints, VDI, jump hosts, and servers with interactive user access.
- Restrict local logon rights and administrative group membership where possible.
- Monitor Microsoft guidance for any later clarification or platform-specific instructions.
Validation and detection
- Inventory Windows assets against the affected versions listed in the CVE source bundle.
- Verify applicable Microsoft updates for CVE-2023-35360 are installed.
- Confirm vulnerable systems are not missing cumulative security updates.
- Review privileged access paths on systems that cannot be patched promptly.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-591: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-35360 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C15.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- Windows Kernel Elevation of Privilege VulnerabilityCVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Sensitive Data Storage in Improperly Locked Memory
Sensitive Data Storage in Improperly Locked Memory represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.