CISA Warns of Microsoft Exchange and Windows CLFS Flaws Exploited in Attacks

CISA issued an urgent alert that two Microsoft flaws—CVE-2023-36424 (Windows CLFS out-of-bounds read enabling local privilege escalation) and CVE-2023-21529 (Exchange deserialization leading to remote code execution)—were added to the Known Exploited Vulnerabilities catalog after being observed in real-world attacks against government and enterprise networks; agencies and organizations are urged to apply patches or discontinue vulnerable products immediately.