The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two (2) actively exploited zero-day vulnerabilities to the Known Exploited Vulnerability (KEV) catalog. The flaws impact both the Microsoft Word and Microsoft Streaming Service Proxy products. The first vulnerability, tracked as CVE-2023-36761 (CVSS score: 6.2) is a Microsoft Word information disclosure flaw that allows the exposure of Windows New Technology LAN Manager (NTLM) hashes. The vulnerability is exploited by threat actors who embed Word documents with malicious macros and code. The malicious Word document files execute in the victim environment if the victims open the document, or simply preview it within the Preview Pane feature of Windows File Explorer. Successful exploitation could allow the unauthorized threat actors to access sensitive information such as account credentials. The second vulnerability, tracked as CVE-2023-36802, is a Microsoft Streaming Service Proxy elevation of privileges (EOP) flaw which could be exploited by threat actors to gain SYSTEM privileges in the victim environment. The vulnerabilities have both been patched, and technical details about the exploitation or suspected threat actors have not been made public at this time to allow as many users as possible to patch their vulnerable systems. The addition of the vulnerabilities to the KEV mandates that all Federal Civilian Executive Branch (FCEB) agencies must patch the flaw by no later than October 3, 2023.