Is CVE-2023-36761 (Microsoft Word Information Disclosure) being exploited in the wild?

Yes. CISA added CVE-2023-36761 to its Known Exploited Vulnerabilities catalogue on 12 September 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Word contains an unspecified vulnerability that allows for information disclosure. Any organisation running the affected product should treat remediation as urgent.

What “exploited in the wild” means for this CVE

For a CVE like this, “exploited in the wild” means there is credible evidence that real attackers are using it against live systems, not just that a proof of concept exists. The practical question is whether exposure is current and operational, which is why KEV listing matters more than abstract vulnerability scoring.

That makes the issue a response priority, not a theoretical patch-management task. A KEV-listed flaw should be treated as an active threat signal, especially when the affected product is widely deployed and the weakness can support information disclosure that may assist follow-on intrusion or reconnaissance.

For triage context, the most useful external references are the CISA Known Exploited Vulnerabilities Catalog and the CVE Program, which help teams distinguish the identifier from the operational exploitation status.

How to confirm exposure and decide what to do next

The first step is to confirm whether Microsoft Word is present in the environment and whether your estate includes the versions and usage patterns that make the flaw relevant. Do not assume exposure is limited to desktop productivity software alone, because document handling often extends into shared file repositories, VDI, and remote-access workflows.

Once exposure is confirmed, prioritise emergency remediation on the systems that open untrusted documents, handle externally sourced files, or sit closest to sensitive data. For practitioners, the important distinction is between “we plan to patch” and “we may already be exposed through normal document workflow,” because information disclosure often becomes useful to an attacker before obvious service disruption appears.

The strongest supporting guidance is the NIST Cybersecurity Framework 2.0 for response discipline, and the FIRST EPSS model if you are using likelihood signals to prioritise a broader backlog around the same time.

What to verify if patching cannot happen immediately

If patching must wait, the immediate objective is to reduce exposure, not to pretend the issue is contained. Restrict document sources, tighten email and download handling, increase monitoring around suspicious document activity, and review whether affected endpoints process especially sensitive material that would make disclosure more damaging.

It is also sensible to check for signs of earlier compromise if the vulnerable product was broadly exposed before remediation. With information disclosure flaws, the risk is not only initial exploitation, but also whether leaked content, configuration data, or embedded references could have enabled later movement or targeting.

The most relevant internal reference for that operational posture is NHIMG’s Zero-Day and Exploited Vulnerabilities Guide, which aligns with the same emergency triage pattern used for actively exploited issues.

Risk and Threat Considerations

A KEV listing changes the risk posture because it indicates live exploitation, not just latent code weakness. For an information disclosure flaw in a ubiquitous document editor, the main concern is that attackers may use the vulnerability for reconnaissance, content theft, or as a foothold into follow-on targeting of the organisation’s users and documents.

Failure mechanism: The flaw can leak information from a document-processing path that users trust, which means exposure may occur through routine file opening rather than a visibly suspicious action.

Impact: Sensitive document content, internal references, or other disclosed details can support targeted intrusion, intelligence gathering, or a broader compromise sequence if attackers combine the leak with other access paths.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.RA-01 — Asset Vulnerability and Risk Identification	Active exploitation status directly informs vulnerability risk prioritisation.
	DE.CM-01 — Networks and Systems Monitored to Detect Events	Exploitation-in-the-wild warrants heightened monitoring for suspicious document activity.
Recommendation — Prioritise remediation for assets tied to exploited vulnerabilities and update risk decisions accordingly. Increase monitoring for anomalous file-opening and document-processing activity on exposed systems.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed CVEs require fast identification and remediation across the asset base.
Recommendation — Track this CVE through vulnerability management and accelerate remediation on affected assets.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	An actively exploited Microsoft Word flaw requires timely remediation and mitigation.
	RA-5 — Vulnerability Monitoring and Scanning	Exposure confirmation depends on knowing where the vulnerable software remains deployed.
Recommendation — Apply flaw remediation actions quickly for affected Word installations and document workflows. Scan for affected Word deployments and verify exposure before closing the remediation task.

Practitioner Guidance

What to prioritise: Treat the KEV status as the deciding factor for urgency. If Word is present on endpoints that handle sensitive or externally supplied documents, move this item ahead of routine backlog work and verify whether those systems are still exposed.

What to verify: Confirm not only that the product exists, but also where documents are opened, where sensitive files travel, and whether affected users have access to data that would make disclosure materially harmful. That determines whether the exposure is nuisance-level or incident-level.

Practitioner takeaway: When a CVE is in KEV, the question is no longer whether exploitation is possible, but how quickly you can remove the attacker’s opportunity before disclosure becomes operationally useful.