No source can show you its own past. This one can.
Print this page to keep the view as it stands on this date. Everything hidden behind a disclosure opens, and every receipt prints with its value.
Windows Search Remote Code Execution Vulnerability
CVE-2023-368844 of 4 sources documented this
rank 73 = 40 + 19 + 0 + 8 + 6
rank@v1 · act now
Someone is already using it
CISA KEV catalog · public proof-of-concept · FIRST EPSS
EPSS 0.98932 · CISA KEV listed · without this subject the record ranks 33
What it costs you if it fires
NVD CVSS base score, then the CNA's own
CVSS 7.5, from the CNA · without this subject the record ranks 54
It is getting worse, not staying still
FIRST EPSS series, rescorings and bad loads removed
no persisting rise in 365 days · without this subject the record ranks 73
How much of the world it touches
NVD CPE configurations
12 products in the CPE ranges · without this subject the record ranks 65
Someone else already set the date
CISA KEV remediation due date
CISA remediation date held · without this subject the record ranks 67
Unaudited dollar value2 of 3 inputs carry a receipt
Exposure$4.94Mover the next 30 days, if this record is yours
Movement+$292,000on 2025-11-21, the last material move, 9 months before this reading
Basisassumeda published average, not your estate
$4.94M = $4.99M incident cost x 1 exposure x 0.98932 likelihood
udv@v1 · unaudited · wrong for you until you say what you run
$4.99M is the cost of a breach that happened, from IBM Cost of a Data Breach Report 2026, global average. It is not the value of any asset of yours. That average already covers breaches of every severity, so scaling it by exposure understates a partial-impact record. That is an assumption, not a measurement. Your own asset value goes in the decision record.
PLATEAUMinimal movement since 2025-11-21, 287 days at 0.99, as of 2026-09-04. arc-rules@v1
Foresight · where to check next
This record is one instance of CWE-362, concurrent execution using shared resource with improper synchronization ('race condition'). The index holds 2679 prior instances of this class, 11 KEV-listed. The nearest of its KEV-listed records are drawn beside this. taxonomy@v1
Prior records in this weakness class. Each is its own record, dated and receipted.
Color is a claim, not decoration:the hostile worldthe defenseno signalspoke length is how much of the record matches, not how bad it is
Running Microsoft Windows 10 Version 1507? Check your version
A deterministic range check against the ranges this record publishes. It tells you where a version sits in the record, not whether your deployment is exploitable. No account needed.
Watch this record
Matches your own product list against every record this index holds, and tells you when one of them moves.
Choose your verdict, then sign in or use an email link. Your first 100 records are free. Evidence is frozen when the record is created.
Private to your organization unless you share it. Put the proof link in your ticket so a reviewer can inspect the basis for your call. See how decision records work.
Harm, if it fires from the vector and the weakness
Written for the ticket you're about to file.
Reachnetwork-reachable · no privileges required · user interaction required · high attack complexityreceipt
ImpactComplete confidentiality, integrity and availability lossreceipt
Patch available sinceNo dated patch-availability record in held sources. The index holds reference URLs without dates and only the current revision of the CVE record, so the day a fix first existed cannot be derived. Only the versions it landed in.
CISA remediation statusoverdue since 2023-08-29receipt
CISA required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.receipt
Published to CISA KEV6 daysderived
Exploit Status & Known PoCs a ladder, not a score
Current rung: Ransomware campaign use known, 2023-07-17.
RUNG 1Nothing observed in held sources
RUNG 2Proof-of-concept published · 9 public repositories2023-07-12receipt
RUNG 3Exploited in the wild · CISA KEV listed2023-07-17receipt
RUNG 4Ransomware campaign use known2023-07-17receipt
Affected productMicrosoft Windows 10 Version 1507; Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2…receipt
Published rangesmicrosoft windows 10 1507 < 10.0.10240.20107; microsoft windows 10 1607 < 10.0.14393.6167; microsoft windows 10 1809 < 10.0.17763.4737; microsoft windows 10 21h2 < 10.0.19044.3324receipt
A rung lights from a row in the index, never from an assessment. "Held sources" is the true scope of the claim: this index reads the CVE record, NVD, CISA KEV, FIRST's EPSS and public proof-of-concept repositories, and it does not observe attacks.
Attack path
What it is stated by the CNA
Windows Search Remote Code Execution Vulnerability receipt
NVD's analysis a second authority
weakness
CWE-362
affected versions
microsoft windows 10 1507 < 10.0.10240.20107; microsoft windows 10 1607 < 10.0.14393.6167; microsoft windows 10 1809 < 10.0.17763.4737; and 9 more, listed in full below
17 Mar 20250.82793 · crossed 0.50 · scoring model v2025.03.14
15 Apr 20250.93071 · crossed 0.90
18 Nov 20250.85548 · crossed 0.90
21 Nov 20250.91406 · crossed 0.90
15 Jun 20260.99083 · scoring model v2026.06.15
1 Aug 20260.98932
This score more than doubled inside 72 hours. Both observations are in the full history below.
Show all 90 observations
12 Jul 20230.00051
18 Jul 20230.49923
26 Jul 20230.76758
1 Aug 20230.87874
9 Aug 20230.62540
13 Aug 20230.58720
20 Aug 20230.61943
12 Sep 20230.57358
15 Sep 20230.48047
23 Sep 20230.45617
13 Oct 20230.48737
18 Oct 20230.53336
13 Nov 20230.42753
28 Nov 20230.47949
14 Dec 20230.50058
24 Jan 20240.54195
17 Feb 20240.52625
27 Feb 20240.50066
9 Mar 20240.46776
22 Mar 20240.50789
31 Mar 20240.52458
13 Apr 20240.53140
24 Apr 20240.49119
30 May 20240.27001
10 Jun 20240.30487
22 Jun 20240.22690
28 Jun 20240.11531
6 Jul 20240.11276
17 Jul 20240.09991
12 Aug 20240.08157
24 Aug 20240.06769
2 Oct 20240.07295
15 Oct 20240.06878
11 Nov 20240.07395
8 Dec 20240.06538
17 Dec 20240.28767
1 Jan 20250.21516
3 Jan 20250.23681
18 Jan 20250.17844
31 Jan 20250.14589
15 Feb 20250.15326
1 Mar 20250.12374
15 Mar 20250.29949
17 Mar 20250.82793
19 Mar 20250.85037
15 Apr 20250.93071
15 May 20250.92169
20 May 20250.93099
26 May 20250.93071
15 Jun 20250.93099
2 Jul 20250.93071
19 Aug 20250.91905
20 Aug 20250.91499
21 Aug 20250.91053
1 Sep 20250.91905
2 Sep 20250.92808
3 Sep 20250.93099
5 Sep 20250.93071
19 Sep 20250.93099
2 Oct 20250.93071
17 Oct 20250.92808
22 Oct 20250.92839
23 Oct 20250.93124
26 Oct 20250.93097
29 Oct 20250.9322
13 Nov 20250.92171
14 Nov 20250.91406
18 Nov 20250.85548
21 Nov 20250.91406
23 Nov 20250.91996
25 Nov 20250.92616
27 Nov 20250.9322
28 Nov 20250.93245
11 Dec 20250.9322
18 Dec 20250.93245
29 Dec 20250.9322
18 Feb 20260.9281
19 Feb 20260.92984
24 Feb 20260.93245
26 Feb 20260.9322
21 Mar 20260.92616
27 Mar 20260.93245
30 Mar 20260.9322
21 Apr 20260.93245
4 May 20260.9322
22 May 20260.93003
28 May 20260.92973
15 Jun 20260.99083
13 Jul 20260.98998
1 Aug 20260.98932
90 observations held. A highlighted step crossed a promotion threshold. A step marked with a scoring model moved because the instrument was replaced, not because the vulnerability changed. receipt
The full biography
Listed by CISA 6 days after it published, exploit probability more than doubled between 2025-03-15 and 2025-03-17 (0.29949 → 0.82793) and the record had been public for 3 years, 1 month when this index was last written.
No material movement in 34 days as of the last ingest this index recorded.
Published 2023-07-11 receipt · Public PoC 2023-07-12 receipt · CISA KEV 2023-07-17 receipt · Index as of 2026-09-04 derived
The pattern, elsewhere
This record is one instance of CWE-362, concurrent execution using shared resource with improper synchronization ('race condition'). The index holds 2679 prior instances of this class, 11 KEV-listed. The nearest of its KEV-listed records are drawn beside this. [email protected]
CVE-2021-21166 · Google Chromematches 7 of 9KEV listed · 2021receipt
CVE-2020-6819 · Mozilla Thunderbirdmatches 7 of 9KEV listed · 2020receipt
CVE-2020-6820 · Mozilla Thunderbirdmatches 7 of 9KEV listed · 2020receipt
CVE-2025-62215 · Microsoft Windows 10 Version 1809matches 6 of 9KEV listed · 2025receipt
CVE-2022-26904 · Microsoft Windows 10 Version 1809matches 6 of 9KEV listed · 2022receipt
CVE-2016-5195matches 5 of 8KEV listed · 2016receipt
"Matches n of m" counts the attributes the two records can both be compared on: the CVSS metrics they share a version of, any weakness class beyond this one, and the vendor. fit-rules@v1
2679 records in this class held. The six above are drawn from the ones CISA has listed as exploited, ranked by how much of the record matches this one. That is why every one of them is KEV-listed: the pool is, so the colour on those spokes says nothing the pool has not already said.
No curated product neighbourhood is held for this product, so the records above are the nearest this index can name. The neighbourhood table covers a small set of products and is extended by hand.
Siblings and hubs
Records related to this one
None. No alias set, and nothing in the corpus cites this identifier or shares its product family within 60 days.