Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchMicrosoft’s July 11, 2023 security release addressed five vulnerabilities that were reported as actively exploited zero-days. They affected different parts of Windows and Office, with impacts ranging from remote code execution to security-feature bypass and elevation of privilege. One important exception: CVE-2023-36884 had no patch in that month’s update.
This is a retrospective account of the July 2023 release, not current deployment advice. Check Microsoft’s July 2023 Security Updates — Release Notes and the current entries in the Security Update Guide for product applicability and present-day remediation.
What Microsoft disclosed in July 2023
Microsoft released its July security updates on July 11, 2023. Dark Reading reported that the release addressed 130 vulnerabilities, including five that were actively exploited and nine rated critical. The 130 figure is Dark Reading’s count, not a count attributed here to Microsoft.
The update covered products and components including Windows, Office, .NET, Azure Active Directory, printer drivers, DNS Server, and Remote Desktop. That broad scope does not mean every product or version was affected by every flaw; applicability must be checked against Microsoft’s release notes and individual CVE guidance.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A zero-day is a vulnerability exploited before a fix is available to the affected user or organization. The label describes the relationship between exploitation and available protection; it does not mean all five flaws had the same impact or remediation status. In particular, CVE-2023-36884 was reported as actively exploited but lacked a patch in the July release.
The five reported zero-days
The table summarizes the issue type and release-time context reported for each vulnerability. Exploitation and patch statements refer to the July 2023 reporting, not current status.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| CVE | Component and impact | Reported prerequisite or scenario | July 11, 2023 patch status |
|---|---|---|---|
| CVE-2023-36884 | Office and Windows HTML; remote code execution | Exploitation was linked to phishing documents opened by targets. | No patch was included in that month’s update. |
| CVE-2023-35311 | Outlook; security-feature bypass | User interaction was required; the flaw could bypass the Outlook Security Notice prompt. | Reported among the actively exploited flaws addressed in the July update. |
| CVE-2023-32049 | Windows SmartScreen; security-feature bypass | User interaction was required; the flaw could bypass the Open File – Security Warning prompt. | Reported among the actively exploited flaws addressed in the July update. |
| CVE-2023-36874 | Windows Error Reporting; elevation of privilege | Local access was required; exploitation could provide administrative rights. | Reported among the actively exploited flaws addressed in the July update. |
| CVE-2023-32046 | Windows MSHTML; elevation of privilege | A crafted or web-hosted file had to be opened by the target. | Reported among the actively exploited flaws addressed in the July update. |
The descriptions and release-time exploitation reporting were reported by Dark Reading on July 11, 2023. Check Microsoft’s current CVE entries for affected versions and remediation details.
Why CVE-2023-36884 stood out
CVE-2023-36884 was the set’s remote-code-execution issue and the one for which the July update did not include a patch. Dark Reading reported Microsoft’s assessment that Storm-0978 exploited it in a phishing campaign targeting government and defense organizations in Europe and North America. The reported lures related to the Ukrainian World Congress and Ukrainian political affairs; the campaign was also associated with delivery of a backdoor.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
“Storm-0978’s targeted operations have impacted government and military organizations primarily in Ukraine, as well as organizations in Europe and North America potentially involved in Ukrainian affairs.”
This is Microsoft’s threat-intelligence statement as quoted in the Dark Reading report. It describes the campaign and organizations Microsoft said were affected; it should not be read as evidence that every recipient of a lure was compromised.
Rank #4
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
How the other four issues differed
The remaining vulnerabilities did not all provide attackers with code execution. CVE-2023-35311 and CVE-2023-32049 were security-feature bypasses: they undermined prompts intended to warn users, and the reported scenarios required user interaction. CVE-2023-36874 and CVE-2023-32046 were local elevation-of-privilege flaws. Their reported exploitation paths depended on local access or a target opening a file, rather than being equivalent to CVE-2023-36884’s remote-code-execution impact.
These distinctions matter when interpreting “five zero-days.” Exploitation status, severity rating, technical impact, prerequisites, and whether a patch was present are separate properties. A zero-day count alone does not show which systems are affected or what action is appropriate for a particular environment.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsBest Value
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How administrators should use the historical report
The July 2023 article is useful for understanding what was disclosed and reported at the time. It is not sufficient to determine current exposure: affected product versions, installed updates, and later guidance must be evaluated against current Microsoft information.
- Identify products and versions. Inventory the Microsoft software in scope, then compare it with Microsoft’s current Security Update Guide and the July release notes.
- Check each CVE’s current guidance. Review applicability, superseding updates, and any current mitigation instructions before acting. Do not assume a July 2023 update alone resolves a system’s present exposure.
- Prioritize based on current exposure and guidance. The historical report identifies five actively exploited flaws, but deployment order should account for current product applicability and your organization’s exposure.
- Test behavior-changing mitigations. MyCERT’s July 19, 2023 advisory described a registry-based mitigation for CVE-2023-36884, warning that it could affect normal functionality in some use cases and recommending testing. It also noted that applications may need restarting if they had already queried and cached the registry value. Treat those as historical advisory details, not universal instructions; verify current Microsoft guidance and test applicability before changing production systems.
- Confirm deployment. After applying an update or mitigation selected for the environment, verify that it installed successfully and that affected applications continue to function as expected.
MyCERT’s historical advisory is available at MA-957.072023: Microsoft Releases July 2023 Security Updates. For operational decisions, use Microsoft’s current guidance for the exact product and CVE.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
