CU23 is failing due to modified permissions on the Auth folder. I'm finding this on select 2013 Exchange Servers that have been compromised.
I was able to get the upgrade to run by changing the permissions on the Auth folder and it's contents. First I changed the owner from System to Domain Admin. Then I added permissions for the local and domain admin accounts. Once this was done I was able to successfully install CU23.