Join our Newsletter — 33% off our NHI Course

How do you patch or mitigate CVE-2023-21715 (Microsoft Office Publisher Security Feature Bypass)?

CISA’s required action for CVE-2023-21715 is to apply updates per vendor instructions. In practice, find every instance of Microsoft Office in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

What you need to verify before treating CVE-2023-21715 as fixed

Patch and mitigation starts with exposure mapping, not just deployment counts. Confirm which Microsoft Office Publisher installations are present, whether they are internet-facing, and whether they are still in active use. For a vulnerability that was exploited in the wild, the most important question is whether any instance remains reachable while unpatched or only partially mitigated.

Use Zero-Day and Exploited Vulnerabilities Guide to triage the issue as an actively exploited weakness, and use CISA Known Exploited Vulnerabilities Catalog to align your remediation work with CISA’s required action.

If Publisher is still needed, verify that the vendor update has been applied to every affected endpoint and that the result is visible in your asset and patch reporting. If the product cannot be updated in time, treat removal of internet exposure or removal from service as a temporary risk-reduction measure, not a substitute for remediation.

How to reduce exposure when patching is delayed

When immediate patching is not possible, the goal is to reduce the attack surface enough that the flaw is no longer a practical entry point. That means limiting who can launch Publisher, restricting network reachability where the product is exposed remotely, and keeping the affected software off systems that do not genuinely need it. For this type of flaw, a partial workaround is only useful if it meaningfully lowers the chance of exploitation before the update lands.

Use Endpoint Hardening Checklist to support the containment side of the response, especially where you need to tighten baselines while waiting for patch windows. If the application is exposed through a broader Microsoft 365 estate, Microsoft 365 Security Guide is the better companion for understanding how endpoint and tenant controls fit together.

Do not rely on compensating controls that only reduce nuisance traffic. If the vulnerable application remains reachable by users who can open untrusted content, or by hosts that are routinely internet-connected, the residual risk stays high until the vendor update is in place or the product is removed.

What to look for after patching

Because attackers used this flaw in the wild, patch completion is only half the response. Review endpoint, email, browser, and Office-related telemetry for signs of suspicious document handling, unusual Publisher launches, follow-on payloads, or later activity that may indicate the initial bypass was used as an entry point. A clean patch status does not prove the system was not already touched.

The post-patch review should focus on whether the vulnerability was used before remediation, not on proving the patch itself behaved correctly. If you find suspicious activity, widen the investigation to adjacent user sessions, downloaded files, and any identity or mail activity that may have followed the initial exploitation path. For vulnerability-driven investigations, Vulnerability Management Guide is useful for structuring verification, exceptions, and remediation follow-up.

Practitioner Guidance: Prioritise this CVE by exposure and likely reachability, not by patch queue order alone; an internet-facing or widely used Office installation deserves faster action than a low-risk endpoint. If you must defer the update, document the compensating control and the date it expires, because temporary containment loses value quickly once users continue normal document workflows.

What to verify: Confirm that every Microsoft Office instance is inventoried, updated per vendor instructions, and no longer exposed in the configuration that made the bypass useful.

Escalation / exception: Escalate immediately if you cannot patch a reachable installation, if Publisher is still needed on a production endpoint, or if logs show possible pre-patch exploitation.

Practitioner takeaway: For exploited flaws, the real control is fast exposure reduction plus evidence-based confirmation that no pre-existing compromise was missed.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
NIST CSF 2.0 ID.RA-01 — Asset Vulnerability Identification CVE response requires identifying exposed vulnerable Office assets.
Recommendation — Inventory exposed Office instances and rank them by exploitability and business reach.
CIS Controls v8 CIS-7 — Continuous Vulnerability Management This is a patch-and-mitigation workflow for an actively exploited vulnerability.
Recommendation — Prioritise and remediate the vulnerable Office deployment using an accelerated vulnerability workflow.
NIST SP 800-53 Rev 5 RA-5 — Vulnerability Monitoring and Scanning The response depends on finding affected installations and verifying remediation.
Recommendation — Scan for affected systems and confirm the update or mitigation is actually deployed.
MITRE ATT&CK T1204 — User Execution Office document abuse commonly relies on user-triggered execution paths.
Recommendation — Hunt for user-driven document execution activity that preceded the suspected exploitation.
OWASP ASVS V16 — Security Logging and Error Handling Post-patch review depends on log evidence of earlier exploitation.
Recommendation — Retain and review logs that can confirm whether the flaw was used before patching.