Bahare Sabouri

**Name of the Vulnerable Software and Affected Versions** Windows Task Scheduler versions prior to the fixed version in November Patch Tuesday **Description** The vulnerability is an elevation-of-privilege issue in the Windows Task Scheduler, allowing attackers to elevate their privileges to Medium Integrity level and gain the ability to execute RPC functions restricted to privileged accounts. This vulnerability has been exploited in the wild, with the RomCom group executing malicious code outside the Firefox sandbox and launching malware from C&C servers. The attack can be performed from an AppContainer restricted environment. **Recommendations** To resolve the issue, apply the patch released in November Patch Tuesday for Windows Task Scheduler. As a temporary workaround, consider restricting access to the Task Scheduler until a patch is applied. Avoid using the Task Scheduler to execute RPC functions that are restricted to privileged accounts until the issue is resolved. Apply the latest security updates to prevent exploitation of this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office and Windows versions (affected versions not specified) **Description** This issue is a remote code execution vulnerability affecting Microsoft Office and Windows systems. It stems from flaws in how input data is processed, specifically related to Office and Windows HTML. Successful exploitation allows attackers to execute arbitrary code remotely, potentially impacting the system. The vulnerability has been actively exploited in the wild by threat actors, including the RomCom (Storm-0978) group, who have used it to deploy Underground Ransomware. The vulnerability allows attackers to bypass Mark of the Web (MOTW) defenses. The exploitation involves a complex chain, potentially utilizing .search-ms files and CHM files. The vulnerability was initially identified as CVE-2023-36884 and has been exploited in targeted attacks against organizations in Europe and North America. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.