CVE-2023-23397
Microsoft Office Outlook Privilege Escalation Vulnerability
Description
CVE-2023-23397 is a critical elevation of privilege vulnerability in Microsoft Outlook that allows remote attackers to steal NTLM authentication hashes without any user interaction. This vulnerability affects Microsoft Outlook, Microsoft 365 Apps, Microsoft Office, and Microsoft Office Long Term Servicing Channel editions. By sending a specially crafted email with a malicious UNC path, an attacker can force the victim's Outlook client to connect to an attacker-controlled server and leak the user's Net-NTLMv2 hash, enabling authentication relay attacks. With a CVSS score of 9.8 (Critical) and confirmed active exploitation by CISA, CVE-2023-23397 is one of the most dangerous Microsoft Outlook vulnerabilities discovered, carrying an EPSS score of 93.66% that indicates near-certain exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | 365 apps | - |
| microsoft | office | 2019 |
| microsoft | office long term servicing channel | 2021 |
| microsoft | outlook | 2013; 2016 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-23397(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
Microsoft Outlook does not properly validate certain properties in calendar invitation emails, allowing attackers to inject malicious UNC paths that trigger automatic NTLM authentication to external servers. This input validation failure enables exploitation without any user interaction beyond receiving the email.
Learn more: CWE-20 — Improper Input Validation
CWE-294: Authentication Bypass by Capture-replay
The vulnerability enables capture-replay attacks where an attacker intercepts NTLM authentication hashes leaked by the Outlook client and relays them to other services. This authentication bypass technique allows attackers to impersonate the victim and gain unauthorized access to network resources.
Learn more: CWE-294 — Authentication Bypass by Capture-replay
Impact Analysis
CVE-2023-23397 represents one of the most impactful Microsoft Outlook vulnerabilities due to its critical severity and zero-click exploitation characteristics. Attack Vector (Network): The vulnerability is exploitable remotely by simply sending a crafted email to the victim — no physical or adjacent network access is required. Attack Complexity (Low): Exploitation is straightforward with no special conditions or race conditions needed. Privileges Required (None): The attacker does not need any prior authentication or access to the target environment. User Interaction (None): This is a zero-click vulnerability — the malicious email is processed by Outlook automatically when received, even before it is displayed in the preview pane. Confidentiality, Integrity, and Availability (all High): Successful exploitation leaks NTLM hashes that enable full account takeover, lateral movement within the network, and potential disruption of services. The CVSS score of 9.8 reflects the maximum exploitability with complete impact across all three security dimensions. With an EPSS score at the 99.84th percentile, this vulnerability is actively targeted by sophisticated threat actors.
Exploit Maturity
CVE-2023-23397 has been actively exploited in the wild since at least early 2023, as confirmed by CISA's inclusion of this vulnerability in the Known Exploited Vulnerabilities catalog with a remediation deadline of April 4, 2023. The vulnerability was initially reported as being exploited by Russian state-sponsored threat actors targeting government, transportation, energy, and military sectors in Europe. The EPSS score of 93.66% at the 99.84th percentile confirms a very high probability of exploitation activity. While no public exploit tagged as such appears in the NVD references, the detailed technical write-ups and proof-of-concept tools available in the security community make this vulnerability highly accessible to attackers of varying skill levels.
Remediation
- Apply Microsoft security updates immediately — Install the March 2023 Patch Tuesday updates for all affected Microsoft Outlook and Office products as described in the Microsoft Security Response Center advisory. Per CISA's directive, apply mitigations or discontinue use if patches are unavailable.
- Block outbound SMB connections — Configure firewalls to block outbound SMB traffic (TCP port 445) and WebDAV connections to external destinations. This prevents Outlook from leaking NTLM hashes to attacker-controlled servers even if a malicious email is received.
- Add users to the Protected Users security group — Members of this Active Directory group are prevented from using NTLM authentication, effectively neutralizing the NTLM relay attack vector exploited by CVE-2023-23397.
- Scan for past exploitation — Microsoft has released a PowerShell script to scan Exchange servers for mail items containing malicious UNC paths indicative of CVE-2023-23397 exploitation attempts. Review Exchange logs and mailboxes for previously received malicious messages.
- Enforce SMB signing and implement Extended Protection for Authentication (EPA) — These measures harden NTLM authentication against relay attacks and provide long-term protection against similar credential theft vulnerabilities.
Technical Details
CVE-2023-23397 exploits a combination of improper input validation (CWE-20) and authentication capture-replay weaknesses (CWE-294) in Microsoft Outlook's handling of calendar invitation properties. The attack leverages the PidLidReminderFileParameter extended MAPI property, which can specify a UNC path for a custom reminder sound. When Outlook processes an email containing a malicious UNC path in this property, it automatically initiates an NTLM authentication handshake with the attacker-controlled server — triggering the leak before the user even sees the email. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms this is a zero-click, unauthenticated, network-based attack with complete impact on confidentiality, integrity, and availability. The captured Net-NTLMv2 hash can be relayed to authenticate against other services supporting NTLM, such as Exchange, SMB shares, or Active Directory, enabling lateral movement and privilege escalation within the target network.
Frequently Asked Questions
Is CVE-2023-23397 being actively exploited?
Yes, CVE-2023-23397 has been actively exploited in the wild by sophisticated threat actors. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of April 4, 2023. The EPSS score of 93.66% confirms ongoing and widespread exploitation activity targeting organizations globally.
What products are affected by CVE-2023-23397?
CVE-2023-23397 affects Microsoft Outlook, Microsoft 365 Apps, Microsoft Office, and Microsoft Office Long Term Servicing Channel editions on Windows. The vulnerability is triggered by receiving a specially crafted email, making all Windows Outlook users on unpatched versions potential targets.
How do I fix CVE-2023-23397?
Apply the March 2023 Microsoft security updates for Outlook and Office products immediately. As interim mitigations, block outbound SMB traffic (TCP 445) at your network perimeter and add users to the Protected Users Active Directory security group to prevent NTLM authentication. See the Remediation section for comprehensive steps.
How severe is CVE-2023-23397?
CVE-2023-23397 is rated Critical with a CVSS score of 9.8 out of 10, the near-maximum severity rating. It is a zero-click vulnerability that requires no user interaction — simply receiving the malicious email triggers exploitation. The EPSS percentile of 99.84% confirms it is among the most actively exploited vulnerabilities currently tracked.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.