CVE-2023-21715
Microsoft Publisher Security Feature Bypass Vulnerability
Microsoft Publisher Security Feature Bypass Vulnerability
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Microsoft Publisher Security Feature Bypass Vulnerability
Microsoft Publisher Security Feature Bypass Vulnerability
- Record
CVE-2023-21715- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2023-25882
Microsoft Publisher Security Feature Bypass Vulnerability
- Record
EUVD-2023-25882- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9gf3-6wpf-hgpx
Microsoft Publisher Security Features Bypass Vulnerability
Microsoft Publisher Security Features Bypass Vulnerability
- Record
GHSA-9gf3-6wpf-hgpx- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
CISA KEV No score
Microsoft Office Publisher Security Feature Bypass Vulnerability
Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.
- Record
CVE-2023-21715- Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
Microsoft Publisher Security Feature Bypass Vulnerability
- Record
CVE-2023-21715- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-21715 is a high vulnerability (CVSS 7.3) in Microsoft 365 Apps, published February 14, 2023. CISA lists it as known to be exploited, since February 14, 2023. EUVD reports exploitation since February 14, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.0%, the 96th percentile. No source names a fixed version.