Is CVE-2023-36563 (Microsoft WordPad Information Disclosure) being exploited in the wild?

Yes. CISA added CVE-2023-36563 to its Known Exploited Vulnerabilities catalogue on 10 October 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft WordPad contains an unspecified vulnerability that allows for information disclosure. Any organisation running the affected product should treat remediation as urgent.

What “exploited in the wild” means for CVE-2023-36563

For a CVE question, the useful distinction is not whether the product has a flaw in theory, but whether defenders should treat it as an active exposure today. Once CISA places a vulnerability in the KEV catalogue, the operational assumption changes: you should respond as if exploitation is already underway somewhere, even if your own environment has not yet shown obvious signs.

That matters because “information disclosure” is often dismissed as lower severity than code execution, yet disclosed data can still support later intrusion steps. When the affected product is installed broadly or sits near sensitive documents, the practical question is whether the flaw can reveal material content, internal state, or other information that reduces an attacker’s effort.

For current triage guidance on exploited vulnerabilities, NHI Management Group’s Zero-Day and Exploited Vulnerabilities Guide explains how to combine KEV status, prioritisation, emergency mitigation and post-patch hunting.

What defenders should check first on affected WordPad systems

The first task is simple exposure confirmation: identify where Microsoft WordPad is installed and whether any endpoint or virtual desktop still allows users to open untrusted files with it. If the software is present on a small number of managed devices, remediation can be surgical. If it is widespread, treat the issue as a fleet-level vulnerability response, not an individual desktop cleanup.

Next, check whether the affected product is actually in use. Many organisations keep legacy components installed even after the business process that required them has disappeared. That creates silent exposure, because the vulnerable surface remains reachable even when no one thinks of the application as important.

When a flaw is already in KEV, prioritisation should also account for blast radius. An information disclosure issue can still expose user content, local application state, cached data, or other material that helps an attacker map the environment. If the product is used to handle sensitive files, the response should be faster than for a low-value workstation tool.

For an inventory-first view of remediation and verification, the Vulnerability Management Guide is the most direct internal reference for asset scoping, exception handling and remediation tracking.

How to handle the window before patching or removal is complete

If immediate patching or removal is not yet possible, reduce exposure instead of waiting passively. Limit who can launch the application, constrain where the software exists, and block unnecessary file sources that could trigger the vulnerable path. Where practical, move sensitive document handling to a less exposed workflow until the vulnerable component is gone.

Because the issue is disclosure rather than direct takeover, compensating controls should focus on shrinking the amount of valuable data the product can reach. That includes tightening local data access, reviewing whether privileged users rely on the tool, and preventing the application from becoming a bridge between ordinary user activity and more sensitive stores.

After remediation, validate the outcome by checking both software presence and user workflow. A vulnerability can remain operationally relevant if the product stays installed for compatibility reasons, so the real goal is not just patch status but the removal of reachable exposure. If the application cannot be removed immediately, document the exception and time-box the remaining risk.

Risk and Threat Considerations

An actively exploited disclosure flaw can be attractive because it is low-friction for attackers and often under-triaged by defenders. Even when the issue does not grant execution, it may expose content that supports follow-on targeting, phishing, credential hunting, or deeper intrusion planning.

Failure mechanism: The attacker abuses the vulnerable WordPad code path to read information that should not be exposed, then uses that visibility to improve later access, targeting or collection activity.

Impact: Sensitive documents or environment details may be revealed, which can widen the attack surface even if the initial exploit does not directly compromise the host.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.RA-01 — Asset Vulnerabilities Are Identified and Documented	Active exploitation makes vulnerability awareness and prioritisation central to this CVE.
	PR.DS-01 — Data-at-Rest is Protected	Information disclosure risks exposing stored content and local data on affected endpoints.
Recommendation — Identify the affected WordPad exposure and prioritize remediation based on confirmed exploitation. Protect sensitive local and document data that WordPad can reach until the flaw is removed.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation requires rapid identification, prioritisation and remediation of the vulnerable product.
Recommendation — Use continuous vulnerability management to find and remediate affected WordPad installations quickly.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	The question is about an actively exploited vulnerability and how to manage it.
	SI-2 — Flaw Remediation	Confirmed exploitation makes timely flaw remediation the primary control action.
Recommendation — Scan for WordPad exposure and track remediation until the vulnerability is removed. Remediate or remove the vulnerable WordPad component as soon as operationally possible.

Practitioner Guidance

What to prioritise: Treat KEV-listed exploitation as a scheduling override. If WordPad exists on systems that handle sensitive or regulated content, move those endpoints to the front of the queue before you spend time on lower-value cleanup work.

What to verify: Confirm three things independently: where WordPad is installed, whether it is actually used, and whether it can access sensitive files or shared locations. Install presence alone is not enough to assess business exposure.

Decision rule: If you cannot patch or remove the product immediately, reduce reachable data first and treat the remaining exposure as a documented exception with a short review cycle, not an open-ended acceptance.

Practitioner takeaway: For an exploited disclosure flaw, the right response is not “does this crash or take over the host?”, but “what information can it reveal, and how much attacker effort does that disclosure remove?”