Microsoft Office Publisher Security Feature Bypass Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Feb 14, 2023 · Catalog

   Detected

   Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.

2. Feb 14, 2023 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Mar 7, 2023 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Aug 19, 2026 · Catalog

   Updated

   Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.

Affected

• cpe microsoft/365 appsversion unspecified
• vendor Microsoft Officeversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2023-21715

  Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.

  cisa.gov
• CVE.orgVulnerability recordCVE-2023-21715

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2023-21715

  30-day exploitation probability 12.0%

  first.org
• NIST NVDVulnerability recordCVE-2023-21715

  Microsoft Publisher Security Feature Bypass Vulnerability

  nvd.nist.gov

References

• CISA note · msrc.microsoft.com
• Patch · msrc.microsoft.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov