# MA-928.042023: MyCERT Advisory - Known Exploited Vulnerabilities Catalog

**Date:** 14 Apr 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-928.042023  
**Advisory ID:** MA-928.042023

---

**1.0 Introduction**
Recently, CISA has added one new vulnerability to its [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), based on evidence of active exploitation.
- [CVE-2023-28252](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-28252) Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability [(https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-28252)](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-28252)
**2.0 Impact**
These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
**3.0 Affected Products**
Multiple versions of Microsoft Windows operating systems.
**4.0 Recommendations**
MyCERT strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of [Catalog vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) as part of their vulnerability management practice. Kindly refer to the link here: <https://www.cisa.gov/known-exploited-vulnerabilities-catalog>
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://www.cisa.gov/news-events/alerts/2023/04/11/cisa-adds-one-known-exploited-vulnerability-catalog>