How do you patch or mitigate CVE-2023-36761 (Microsoft Word Information Disclosure)?

CISA’s required action for CVE-2023-36761 is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. In practice, find every instance of Microsoft Word in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

What CVE-2023-36761 means operationally

CVE-2023-36761 is not a tuning issue, it is a software exposure problem that should be handled like any other actively exploited vulnerability. The practical question is whether Microsoft Word exists anywhere in your environment, whether the vendor security update or mitigation is available, and whether you can remove the affected exposure if you cannot remediate quickly.

For most teams, the first pass is simple inventory and ownership. Identify every installed Word instance, confirm which endpoints, virtual desktops, and shared workstations are reachable from user browsing or document workflows, and then decide whether the vendor action can be applied without business disruption. If the vulnerable product cannot be brought to a safe state, the fallback is to discontinue use or remove the exposure path.

When patching is feasible, the important detail is not just installing a fix, but verifying that the fix actually covers the environment where the product is used. That means checking image baselines, remote access hosts, and any system that opens untrusted documents. A patch on one workstation does not help if a managed image, an offline laptop, or a published desktop still runs the same vulnerable build.

How to reduce exposure when remediation is delayed

If you cannot immediately apply the vendor update or mitigation, focus on blast-radius reduction rather than trying to preserve full functionality. Remove internet exposure where possible, limit document handling to controlled systems, and treat incoming files as hostile until the vulnerability is remediated. For this kind of issue, delay is itself a risk because the flaw was exploited in the wild.

Mitigation should be documented in a way that security, endpoint, and operations teams can all verify. If the vendor provides a specific workaround, make it the standard state and track exceptions tightly. If no effective workaround exists, the decision should move from containment to service removal, because a known exploited flaw without a valid mitigation is an unacceptable standing exposure.

Posture also matters after the immediate fix. Review whether users or processes handled malicious documents before remediation, and look for unusual child processes, document launches, outbound connections, or crash patterns around Word activity. If you find evidence that the issue may have been used, broaden the review to adjacent endpoints that handled the same content or shared the same delivery path.

What to verify after patching or mitigation

After remediation, confirm that the vulnerable version is no longer present anywhere in the asset inventory and that the mitigation is still enforced after reboots, image refreshes, and software updates. If the problem was handled by removal or isolation rather than patching, make sure the control remains in place and has not been undone by a later support change or business exception.

Also verify the human side of the response. Make sure owners know which systems were affected, which files or channels were involved, and what monitoring remains in place. In exploited vulnerability cases, the technical fix is only part of the response, because later triage depends on having a clean record of where the software ran and who may have interacted with it.

Practitioner takeaway: Treat exploited document-processing flaws as an exposure-management problem, not a patch ticket. The correct outcome is either verified remediation everywhere Word runs or a deliberate decision to remove the unsafe exposure until it can be fixed.

Risk and Threat Considerations

The main risk is that an information disclosure flaw in a ubiquitous document application can be reached through ordinary user activity, which makes exposure hard to spot and easy to underestimate. Once the flaw is being used in the wild, the concern is not only the initial disclosure, but the follow-on opportunity for attackers to learn something useful about the victim environment.

Failure mechanism: Untrusted content or crafted document handling paths can trigger information disclosure before defenders notice, especially when the application is broadly deployed and inconsistently patched.

Impact: Attackers may obtain data that helps them refine targeting, support follow-on intrusion, or identify additional systems worth attacking, so delayed remediation increases both direct exposure and downstream compromise risk.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.AM-01 — Identities and assets are inventoried	Inventorying every Word instance is required to confirm exposure.
	PR.DS-01 — Data-at-rest is protected	Mitigation and isolation aim to prevent disclosure of sensitive data through the flaw.
	DE.CM-01 — Networks and network services are monitored	Post-patch review for exploitation depends on monitoring activity around document handling.
Recommendation — Inventory all Word installations and remove or isolate any unremediated exposure. Apply the vendor fix or constrain exposure so disclosure paths are closed. Monitor document-processing activity for signs of prior exploitation.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE response is centered on applying the vendor update or mitigation.
	RA-5 — Vulnerability Monitoring and Scanning	Confirming exposure and finding remaining Word installs requires vulnerability discovery.
	AU-6 — Audit Record Review, Analysis, and Reporting	Reviewing logs after patching aligns with investigating possible earlier exploitation.
Recommendation — Apply the vendor-supported fix or mitigation and verify it across the estate. Scan for remaining vulnerable Word instances and track remediation to closure. Review logs and alert data for indicators of exploitation before remediation.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	CVE remediation and validation are core continuous vulnerability management tasks.
	CIS-2 — Inventory and Control of Software Assets	You must find every Word instance before remediation can be complete.
Recommendation — Prioritise this CVE in your vulnerability workflow and verify closure on every asset. Build a complete software inventory so no affected Word instance is missed.
MITRE ATT&CK	T1203 — Exploitation for Client Execution	Exploited document flaws commonly enter through client-side document processing.
Recommendation — Map observed document-triggered behavior to client-side exploitation paths in detection.

Practitioner Guidance

What to prioritise: Start with asset discovery and exposure reduction, then move to the vendor update or documented mitigation. If you cannot confirm both the fix and the remaining exposure state, do not assume the environment is safe.

What to verify: Confirm not just that Word was patched, but that every delivery path, image, and endpoint class that can open the product is covered. Review telemetry for suspicious document opens, abnormal child processes, and unusual network activity around the affected timeframe.

Decision rule: If no vendor-supported mitigation can be applied quickly, remove the product from exposed use rather than waiting for a convenient maintenance window. For actively exploited flaws, “temporary acceptance” is usually just extended exposure.

Practitioner takeaway: The decisive question is whether you can prove the vulnerable software is gone or safely constrained everywhere it runs. If you cannot prove that, the risk is still live.