CVE-2023-36037: Microsoft Excel Auth Bypass Vulnerability

CVE-2023-36037 Overview

CVE-2023-36037 is a security feature bypass vulnerability in Microsoft Excel that affects multiple supported Office product lines. Microsoft disclosed the issue as part of its November 2023 security update cycle. The flaw allows an attacker to bypass an Excel security control when a user opens a specially crafted spreadsheet on a vulnerable host.

Exploitation requires local access and user interaction, but a successful attack delivers high impact across confidentiality, integrity, and availability. The vulnerability affects Microsoft 365 Apps, Microsoft Excel 2016, Microsoft Office 2019, and the Office Long Term Servicing Channel 2021 on both Windows and macOS builds.

Critical Impact
A crafted Excel document can bypass a Microsoft Office security feature, enabling code execution paths that would normally be blocked by Office protections.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Excel 2016 (x64 and x86)
Microsoft Office 2019 and Office Long Term Servicing Channel 2021 (Windows and macOS)

Discovery Timeline

2023-11-14 - CVE-2023-36037 published to NVD by Microsoft
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-36037

Vulnerability Analysis

The vulnerability is classified as a security feature bypass in Microsoft Excel. Microsoft has not published detailed root-cause information, and the NVD entry maps it to NVD-CWE-noinfo. Security feature bypass issues in Office typically involve weaknesses in protections such as Protected View, Mark-of-the-Web enforcement, macro warnings, or Office Trust Center policy checks.

An attacker exploits the flaw by crafting an Excel workbook that evades one of these protections. When a user opens the file, Excel processes embedded content without applying the expected security restrictions. This bypass becomes a stepping stone for follow-on actions, such as executing macros or loading active content that would otherwise be blocked.

The attack vector is local and the attack complexity is low, but successful exploitation requires the target to open the malicious document. There are no privilege requirements, and the scope is unchanged. Confidentiality, integrity, and availability impacts are each rated high.

Root Cause

Microsoft has not released specific root-cause details. Refer to the Microsoft Security Update for CVE-2023-36037 for vendor guidance and updated build information.

Attack Vector

An attacker delivers a crafted .xlsx, .xlsm, or related Excel file to the target through email, a shared drive, or a download link. When the victim opens the file in a vulnerable build of Excel, the embedded content bypasses the affected Office security control. No network access to the target is required; the attack relies on user interaction with the document.

No public proof-of-concept code is listed for this CVE, and Microsoft did not report exploitation in the wild at disclosure. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2023-36037

Indicators of Compromise

Inbound Excel attachments from untrusted senders that prompt users to disable Protected View or enable content.
Excel processes (EXCEL.EXE) spawning unusual child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Excel writing executable or script files to user-writable paths such as %TEMP%, %APPDATA%, or %PUBLIC%.
Outbound network connections initiated by Excel to non-Microsoft infrastructure shortly after document open.

Detection Strategies

Hunt for parent-child process chains where Office applications launch script interpreters or living-off-the-land binaries.
Inspect Excel files in mail and web gateways for embedded macros, OLE objects, and external links that target Office security boundaries.
Correlate document open events with file write and network telemetry on the same host to surface bypass-enabled payload delivery.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office child processes and Office macro behaviors.
Forward Office telemetry, Sysmon process events, and EDR detections to a centralized analytics platform for correlation.
Track Office build numbers across the fleet to confirm that the November 2023 security update is installed on every endpoint.

How to Mitigate CVE-2023-36037

Immediate Actions Required

Apply the November 2023 Microsoft security updates to all affected Microsoft 365 Apps, Excel 2016, Office 2019, and Office LTSC 2021 installations.
Verify patch deployment status across Windows and macOS Office endpoints, including managed and unmanaged devices.
Restrict opening of Excel files received from external or untrusted sources until patching is confirmed.

Patch Information

Microsoft released fixes through the November 14, 2023 Patch Tuesday update cycle. Refer to the Microsoft Security Update Guide for CVE-2023-36037 for the specific build numbers and KB articles for each supported channel.

Workarounds

Enforce Protected View for files originating from the internet and email attachments through Office Group Policy.
Disable macros by default and require digital signatures for macro execution in Excel.
Block or quarantine Excel attachments at the email gateway pending patch validation.
Apply Microsoft Defender Attack Surface Reduction rules that prevent Office applications from creating child processes.

bash

# Example Group Policy registry settings to enforce Excel Protected View
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
# Block macros from running in Office files from the internet
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f