Microsoft Outlook Remote NTLM Credential Theft & Elevation of Privilege Vulnerability (CVE-2023-23397) Critical Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTAll supported desktop versions of Microsoft Outlook for Windows, including Outlook 2013, 2016, LTSC 2021, and Microsoft 365 Apps
Attackers can trigger the vulnerability silently without user interaction (Zero-Click) simply by sending a malicious email, leaking the user's NTLM hash to external servers for NTLM relay attacks
Apply the official Microsoft security updates immediately, block outbound SMB traffic (TCP port 445) at the perimeter, and run the Exchange audit script to purge malicious items
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to apply the official security updates provided by Microsoft. In enterprise environments, deploy the updates via WSUS/SCCM. For individual systems, you can force Windows Update using the following PowerShell commands:
# Install Windows Update module and force install the security updates
Install-Module PSWindowsUpdate -Force -SkipPublisherCheck
Get-WindowsUpdate -KBArticleID KB5002345, KB5002265, KB5002254 -Install -AcceptAll -AutoReboot2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, block all outbound SMB traffic (TCP port 445) at your perimeter and local firewalls to prevent NTLM hashes from leaving the network. Additionally, add sensitive administrative accounts to the 'Protected Users' security group in Active Directory to restrict NTLM usage.
# Block all outbound SMB (TCP 445) traffic via Windows Advanced Firewall
New-NetFirewallRule -DisplayName 'Block Outbound SMB TCP 445' -Direction Outbound -LocalPort 445 -Protocol TCP -Action Block3. Log Audit & IoC Verification Commands
Use the official script provided by Microsoft (CVE-2023-23397.ps1) to scan Exchange mailboxes for the presence of malicious MAPI properties.
# Run the official Microsoft script in Exchange Management Shell to detect malicious MAPI properties
# Note: Ensure you have downloaded the official script from Microsoft's repository prior to execution.
.\CVE-2023-23397.ps1 -Environment OnPremises -ViewOnly -AffectedEmailsOnlyBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in how Microsoft Outlook for Windows handles notification sounds for emails, appointments, and tasks. Outlook utilizes the MAPI (Messaging Application Programming Interface) property 'PidLidRemainderFileParameter' to specify the audio file path to play when a reminder is triggered. Because the Outlook API fails to properly validate the input path and accepts arbitrary Universal Naming Convention (UNC) paths, an attacker can force the client to establish an outbound connection to an external SMB server, leading to input validation bypass (CWE-20) and authentication bypass (CWE-294).
2. Exploitation Mechanics & Attack Scenario
An attacker crafts a malicious email or calendar invitation containing specific MAPI properties, specifically setting 'PidLidRemainderFileParameter' to an external UNC path and 'PidLidRemainderOverride' to True. This is a highly critical 'Zero-Click' exploit. The victim does not need to open or preview the email; as soon as the Outlook client receives and processes the message in the background to trigger the reminder, the vulnerability is executed. Outlook automatically attempts to connect to the attacker-controlled SMB share (e.g., '\\attacker-ip\share\sound.wav'), initiating a NetNTLMv2 authentication handshake and transmitting the victim's NTLM hash to the attacker. The attacker can then relay this hash to authenticate against other internal network resources.
3. Infrastructure & Business Impact
With a CVSS score of 9.8, this vulnerability represents a severe threat and is actively exploited in the wild, as confirmed by its inclusion in the CISA KEV catalog. If an attacker successfully captures the NTLM hash of a high-privilege account or domain administrator, they can perform NTLM relay attacks to compromise the entire Active Directory (AD) domain. In environments where outbound SMB traffic to the internet is permitted, a single malicious email can lead to a full-scale corporate network compromise.
Official Vendor Advisories & References
Microsoft Outlook Elevation of Privilege Vulnerability
Frequently Asked SecOps Questions (CVE-2023-23397)
FAQQ1. How critical is CVE-2023-23397 and is it actively exploited in the wild?
CVE-2023-23397 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 97.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-23397?
Primary impacted vendors include microsoft across outlook, office. Scope summary: Microsoft Outlook 2013, 2016, 2019, LTSC 2021, and Microsoft 365 Apps for Enterprise on Windows. Outlook for Mac, iOS, Android, and Outlook on the Web (OWA) are not affected.
Q3. What temporary mitigations or workarounds exist for CVE-2023-23397 before patching?
[Mitigation] Apply the official Microsoft security updates immediately, block outbound SMB traffic (TCP port 445) at the perimeter, and run the Exchange audit script to purge malicious items Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-23397
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft Office Word Security Feature Bypass Vulnerability (CVE-2026-21514) Analysis and Mitigation Guide
[Affected Scope] Microsoft Office Word and associated Office suites
Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Microsoft Windows Shell Security Feature Bypass Vulnerability (CVE-2026-21510) Urgent Security Advisory
[Affected Scope] Windows Shell component across Microsoft Windows operating systems
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.