CVE-2023-21690
📛 CVE Title
Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
Description
Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
Overview
- State
- PUBLISHED
- Assigner (CNA)
- microsoft
- CVSS severity
- CRITICAL
- CVSS score
- 9.8 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C- Effective score
- 9.8 / 10 CRITICAL source: CNA overview
- MSRC score
- 9.8 / 10 CRITICAL MS rating: Critical · Remote Code Execution
- CWE(s)
-
CWE-122 - Reserved
- 2022-12-13
- Published
- 2023-02-14 08:00 UTC
- Last updated
- 2023-02-14 08:00 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/21xxx/CVE-2023-21690.json
- Linked Threat
- CVE-2023-21690 — Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2023-02-14 20:15:12 UTC
- NVD last modified
- 2026-06-17 05:33:40 UTC
- NVD CVSS v3.1
- 9.8 / 10 CRITICAL source: secure@microsoft.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Exploitability subscore
- 3.9 / 10
- Impact subscore
- 5.9 / 10
- EPSS score
- 0.2753 (probability of exploitation in next 30 days)
- EPSS percentile
- 97.87% vs all CVEs — higher = more likely to be exploited, as of 2026-07-28
NVD / KEV / EPSS data refreshed 2026-07-28 15:14 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2023-25857 - Assigner
- microsoft
- Published
- Feb 14, 2023, 7:33:30 PM
- Updated
- Jan 1, 2025, 12:41:10 AM
- EUVD base score (CVSS 3.1)
-
9.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - EUVD-reported EPSS
- 27.5200
- Vendors
- Microsoft
- Products
-
Windows Server 2019 (10.0.17763.0 <10.0.17763.4010)Windows 10 Version 1809 (10.0.17763.0 <10.0.17763.4010)Windows Server 2019 (Server Core installation) (10.0.17763.0 <10.0.17763.4010)Windows 11 version 21H2 (10.0.0 <10.0.22621.1574)Windows Server 2022 (10.0.20348.0 <10.0.20348.1547)Windows Server 2012 (6.2.9200.0 <6.2.9200.24116)Windows Server 2016 (Server Core installation) (10.0.14393.0 <10.0.14393.5717)Windows 10 Version 1607 (10.0.14393.0 <10.0.14393.5717)Windows 10 Version 21H2 (10.0.19043.0 <10.0.19044.2604)Windows Server 2016 (10.0.14393.0 <10.0.14393.5717)Windows 10 Version 22H2 (10.0.19045.0 <10.0.19045.2604)Windows 10 Version 1809 (10.0.0 <10.0.17763.4010)Windows 10 Version 1507 (10.0.10240.0 <10.0.10240.19747)Windows Server 2008 R2 Service Pack 1 (Server Core installation) (6.1.7601.0 <6.1.7601.26366)Windows 10 Version 20H2 (10.0.0 <10.0.19042.2604)Windows Server 2008 R2 Service Pack 1 (6.1.7601.0 <6.1.7601.26366)Windows Server 2012 (Server Core installation) (6.2.9200.0 <6.2.9200.24116)Windows 11 version 22H2 (10.0.22621.0 <10.0.22621.1265)Windows Server 2012 R2 (Server Core installation) (6.3.9600.0 <6.3.9600.20821)Windows Server 2012 R2 (6.3.9600.0 <6.3.9600.20821)
- Aliases
-
GHSA-wr34-5f4g-8569
ENISA description: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
EUVD references (1)
Microsoft Security Response Center MSRC
Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-08-11 01:49 UTC (source: CVRF).
- MS severity
- Critical
- Impact
- Remote Code Execution
- MS CVSS base score
- 9.8 / 10 (temporal 8.5)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Exploit assessment
- Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;DOS:N/A
- Release
- 2023-Feb
Microsoft remediations / KB articles (25)
- 5022840 — Vendor Fix / Security Update (fixed build 10.0.17763.4010)
- 5022840 — Update
- 5022842 — Vendor Fix / Security Update (fixed build 10.0.20348.1547)
- 5022842 — Update
- 5022921 — Vendor Fix / Security Hotpatch Update (fixed build 10.0.20348.1540)
- 5022834 — Vendor Fix / Security Update (fixed build 10.0.19042.2604)
- 5022834 — Update
- 5022836 — Vendor Fix / Security Update (fixed build 10.0.22621.1574)
- 5022845 — Vendor Fix / Security Update (fixed build 10.0.22621.1265)
- 5022845 — Update
- 5022858 — Vendor Fix / Security Update (fixed build 10.0.10240.19747)
- 5022838 — Vendor Fix / Security Update (fixed build 10.0.14393.5717)
- 5022872 — Vendor Fix / Monthly Rollup (fixed build 6.1.7601.26366)
- 5022872 — Update
- 5022874 — Vendor Fix / Security Only (fixed build 6.1.7601.26366)
- 5022874 — Update
- 5022903 — Vendor Fix / Monthly Rollup (fixed build 6.2.9200.24116)
- 5022903 — Update
- 5022895 — Vendor Fix / Security Only (fixed build 6.2.9200.24116)
- 5022895 — Update
- 5022899 — Vendor Fix / Monthly Rollup (fixed build 6.3.9600.20821)
- 5022899 — Update
- 5022894 — Vendor Fix / Security Only (fixed build 6.3.9600.20821)
- 5022894 — Update
- <p>Microsoft Protected Extensible Authentication Protocol (PEAP) is only negotiated with the client if NPS is running on the Windows Server and has a network policy configured that allows PEAP. To stop using PEAP, customers should ensure that PEAP Type is not configured as an allowed EAP type in their network policy. To learn more, please see<a href="https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/wireless/e-wireless-access-deployment#bkmk_configureprofile"> Configure the New Wireless Network Policy</a> and <a href="https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-np-configure">Configure Network Policies</a></p> — Mitigation
Microsoft FAQ (1)
How could an attacker exploit this vulnerability?
An unauthenticated attacker could attack a Microsoft Protected Extensible Authentication Protocol (PEAP) Server by sending specially crafted malicious PEAP packets over the network.
Affected products (20)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Microsoft | Windows 10 Version 1809 |
10.0.17763.0 (affected)
|
32-bit Systems, x64-based Systems |
| Microsoft | Windows 10 Version 1809 |
10.0.0 (affected)
|
ARM64-based Systems |
| Microsoft | Windows Server 2019 |
10.0.17763.0 (affected)
|
x64-based Systems |
| Microsoft | Windows Server 2019 (Server Core installation) |
10.0.17763.0 (affected)
|
x64-based Systems |
| Microsoft | Windows Server 2022 |
10.0.20348.0 (affected)
|
x64-based Systems |
| Microsoft | Windows 10 Version 20H2 |
10.0.0 (affected)
|
32-bit Systems, ARM64-based Systems |
| Microsoft | Windows 11 version 21H2 |
10.0.0 (affected)
|
x64-based Systems, ARM64-based Systems |
| Microsoft | Windows 10 Version 21H2 |
10.0.19043.0 (affected)
|
32-bit Systems, ARM64-based Systems, x64-based Systems |
| Microsoft | Windows 11 version 22H2 |
10.0.22621.0 (affected)
|
ARM64-based Systems, x64-based Systems |
| Microsoft | Windows 10 Version 22H2 |
10.0.19045.0 (affected)
|
x64-based Systems, ARM64-based Systems, 32-bit Systems |
| Microsoft | Windows 10 Version 1507 |
10.0.10240.0 (affected)
|
32-bit Systems, x64-based Systems |
| Microsoft | Windows 10 Version 1607 |
10.0.14393.0 (affected)
|
32-bit Systems, x64-based Systems |
| Microsoft | Windows Server 2016 |
10.0.14393.0 (affected)
|
x64-based Systems |
| Microsoft | Windows Server 2016 (Server Core installation) |
10.0.14393.0 (affected)
|
x64-based Systems |
| Microsoft | Windows Server 2008 R2 Service Pack 1 |
6.1.7601.0 (affected)
|
x64-based Systems |
| Microsoft | Windows Server 2008 R2 Service Pack 1 (Server Core installation) |
6.1.7601.0 (affected)
|
x64-based Systems |
| Microsoft | Windows Server 2012 |
6.2.9200.0 (affected)
|
x64-based Systems |
| Microsoft | Windows Server 2012 (Server Core installation) |
6.2.9200.0 (affected)
|
x64-based Systems |
| Microsoft | Windows Server 2012 R2 |
6.3.9600.0 (affected)
|
x64-based Systems |
| Microsoft | Windows Server 2012 R2 (Server Core installation) |
6.3.9600.0 (affected)
|
x64-based Systems |
Affected products — CPE 2.3 (28) NVD
NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.
cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:arm64:*cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:x86:*cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:arm64:*cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
Web references (24)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- 5022834 msrc
- 5022836 msrc
- 5022838 msrc
- 5022840 msrc
- 5022842 msrc
- 5022845 msrc
- 5022858 msrc
- 5022872 msrc
- 5022874 msrc
- 5022894 msrc
- 5022895 msrc
- 5022899 msrc
- 5022903 msrc
- MSRC update guide: CVE-2023-21690 msrc
- 5022834 msrc
- 5022840 msrc
- 5022842 msrc
- 5022845 msrc
- 5022872 msrc
- 5022874 msrc
- 5022894 msrc
- 5022895 msrc
- 5022899 msrc
- 5022903 msrc
NVD-tagged references (2)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21690 secure@microsoft.com PatchVendor Advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21690 af854a3a-2127-422b-91ae-364da2661108 PatchVendor Advisory
Remediations (15)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:gemini.google.com
Meet Gemini, Google's AI assistant. Get help with writing, planning, brainstorming, and more. Experience the power of generative AI.
2026-06-04 05:13 UTC -
web:www.oracle.com
Critical Security Patch Updates Critical Security Patch Updates provide security patches for supported Oracle on-premises products. A Critical Security Patch Update provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption.
2026-06-04 05:13 UTC -
web:krebsonsecurity.com
Microsoft today pushed updates to fix at least 56 security flaws in its Windows operating systems and supported software. This final Patch Tuesday of 2025 tackles one zero-day bug that is already ...
2026-06-04 05:13 UTC -
web:www.rapid7.com
Microsoft is publishing 137 vulnerabilities on May 2026 Patch Tuesday, including critical RCE in Netlogon and the Windows DNS client.
2026-06-04 05:13 UTC -
web:access.redhat.com
Learn about our open source products, services, and company. You are here
2026-06-04 05:13 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-22 05:45 UTC -
web:www.bleepingcomputer.com
Today is Microsoft's March 2026 Patch Tuesday with security updates for 79 flaws, including 2 publicly disclosed zero-day vulnerabilities.
2026-05-22 05:45 UTC -
web:www.helpnetsecurity.com
Microsoft has marked May 2026 Patch Tuesday by releasing fixes for 120+ CVE -numbered vulnerabilities, none of which are actively exploited.
2026-05-22 05:45 UTC -
web:www.maketecheasier.com
Check out the latest Windows 11 and Windows 10 update problems and their solutions, as recommended by Microsoft experts.
2026-05-22 05:45 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-05-22 05:45 UTC -
web:www.virustotal.com
VirusTotal is a platform for scanning files and URLs for viruses, malware, and other threats using multiple antivirus engines.
2026-05-22 05:45 UTC -
web:blog.qualys.com
Key Takeaways RedSun is a critical zero-day vulnerability in Microsoft Defender that allows low-privileged users to gain SYSTEM access No patch is currently available, leaving all Defender-enabled Windows systems potentially exposed Qualys VMDR detects affected assets instantly (QID 92382) TruRisk™ Eliminate enables immediate mitigation , removing exploitability without waiting for a fix ...
2026-05-22 05:45 UTC -
web:cybersecuritynews.com
Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.
2026-05-22 05:45 UTC -
web:helpx.adobe.com
This page contains important information regarding security vulnerabilities that could affect specific versions of Adobe products. Use this information to take the prescribed corrective actions.
2026-05-22 05:45 UTC -
web:krebsonsecurity.com
For a clickable, per- patch breakdown, check out the SANS Internet Storm Center Patch Tuesday roundup. Running into problems applying any of these updates?
2026-05-22 05:45 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2023-21690.json.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T09:44:01.987Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21690"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Windows 10 Version 1809",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.17763.4010",
"status": "affected",
"version": "10.0.17763.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"ARM64-based Systems"
],
"product": "Windows 10 Version 1809",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.17763.4010",
"status": "affected",
"version": "10.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2019",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.17763.4010",
"status": "affected",
"version": "10.0.17763.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2019 (Server Core installation)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.17763.4010",
"status": "affected",
"version": "10.0.17763.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2022",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.20348.1547",
"status": "affected",
"version": "10.0.20348.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"ARM64-based Systems"
],
"product": "Windows 10 Version 20H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.19042.2604",
"status": "affected",
"version": "10.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems",
"ARM64-based Systems"
],
"product": "Windows 11 version 21H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.22621.1574",
"status": "affected",
"version": "10.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 10 Version 21H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.19044.2604",
"status": "affected",
"version": "10.0.19043.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 11 version 22H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.22621.1265",
"status": "affected",
"version": "10.0.22621.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems",
"ARM64-based Systems",
"32-bit Systems"
],
"product": "Windows 10 Version 22H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.19045.2604",
"status": "affected",
"version": "10.0.19045.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Windows 10 Version 1507",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.10240.19747",
"status": "affected",
"version": "10.0.10240.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Windows 10 Version 1607",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.14393.5717",
"status": "affected",
"version": "10.0.14393.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2016",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.14393.5717",
"status": "affected",
"version": "10.0.14393.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2016 (Server Core installation)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.14393.5717",
"status": "affected",
"version": "10.0.14393.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2008 R2 Service Pack 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "6.1.7601.26366",
"status": "affected",
"version": "6.1.7601.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "6.1.7601.26366",
"status": "affected",
"version": "6.1.7601.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2012",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "6.2.9200.24116",
"status": "affected",
"version": "6.2.9200.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2012 (Server Core installation)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "6.2.9200.24116",
"status": "affected",
"version": "6.2.9200.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2012 R2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "6.3.9600.20821",
"status": "affected",
"version": "6.3.9600.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2012 R2 (Server Core installation)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "6.3.9600.20821",
"status": "affected",
"version": "6.3.9600.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*",
"versionEndExcluding": "10.0.17763.4010",
"versionStartIncluding": "10.0.17763.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*",
"versionEndExcluding": "10.0.17763.4010",
"versionStartIncluding": "10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.17763.4010",
"versionStartIncluding": "10.0.17763.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.17763.4010",
"versionStartIncluding": "10.0.17763.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.20348.1547",
"versionStartIncluding": "10.0.20348.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_20H2:*:*:*:*:*:*:x86:*",
"versionEndExcluding": "10.0.19042.2604",
"versionStartIncluding": "10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_21H2:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "10.0.22621.1574",
"versionStartIncluding": "10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*",
"versionEndExcluding": "10.0.19044.2604",
"versionStartIncluding": "10.0.19043.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_22H2:*:*:*:*:*:*:arm64:*",
"versionEndExcluding": "10.0.22621.1265",
"versionStartIncluding": "10.0.22621.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "10.0.19045.2604",
"versionStartIncluding": "10.0.19045.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*",
"versionEndExcluding": "10.0.10240.19747",
"versionStartIncluding": "10.0.10240.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*",
"versionEndExcluding": "10.0.14393.5717",
"versionStartIncluding": "10.0.14393.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.14393.5717",
"versionStartIncluding": "10.0.14393.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.14393.5717",
"versionStartIncluding": "10.0.14393.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2008_R2:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "6.1.7601.26366",
"versionStartIncluding": "6.1.7601.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2008_R2:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "6.1.7601.26366",
"versionStartIncluding": "6.1.7601.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "6.2.9200.24116",
"versionStartIncluding": "6.2.9200.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "6.2.9200.24116",
"versionStartIncluding": "6.2.9200.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "6.3.9600.20821",
"versionStartIncluding": "6.3.9600.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "6.3.9600.20821",
"versionStartIncluding": "6.3.9600.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2023-02-14T08:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-01T00:41:10.297Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21690"
}
],
"title": "Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2023-21690",
"datePublished": "2023-02-14T19:33:30.262Z",
"dateReserved": "2022-12-13T18:08:03.487Z",
"dateUpdated": "2025-01-01T00:41:10.297Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}