CVE-2023-28229: Windows CNG Key Isolation Service Elevation of Privilege

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a confirmed exploited-in-the-wild local privilege escalation with a CVSS base score of 7.0 and broad Windows coverage, though it requires local access and high attack complexity.

What it is

The Windows CNG Key Isolation Service (KeyIso) contains an elevation of privilege flaw. A local attacker with low privileges can exploit it to gain SYSTEM-level access on affected Windows 10, Windows 11, and Windows Server systems. Because the service handles cryptographic key material, successful exploitation undermines the platform's key isolation boundary.

Impact

An attacker gains full control of the affected host, escalating from a low-privileged local account to SYSTEM. This allows tampering with cryptographic operations, credential material, and other protected resources.

Attack surface

Reached locally, as indicated by the AV:L vector; the attacker must already have code execution and a low-privileged account (PR:L). No user interaction is required (UI:N), and the attack complexity is rated high (AC:H).

Exploitation

CVE-2023-28229 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming exploitation in the wild, though EPSS 30-day probability is low at roughly 1.7 percent. CISA does not flag it for known ransomware campaign use.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2023-28229 across all affected Windows versions.
• Prioritize patching internet-facing and high-value systems, and meet the CISA KEV remediation due date of 2023-10-25.
• Restrict and monitor local interactive logon and code execution paths that could be used to reach the KeyIso service.
• If patching is not immediately possible, follow vendor mitigations or discontinue use of the affected product per CISA guidance.

Detection

• Monitor for unexpected processes spawning from or interacting with the CNG Key Isolation Service (KeyIso) and for anomalous token or privilege changes to SYSTEM.
• Alert on suspicious local privilege escalation behavior, such as unusual access to cryptographic key containers or KeyIso-related registry and file paths.
• Correlate Windows security event logs for low-privileged accounts gaining SYSTEM-level tokens or service manipulation shortly after initial access.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.