Threat alert details
We would like to bring your attention to a critical vulnerability within Microsoft Outlook which allows for elevation of privileges with a CVSS3 score of 9.8. This vulnerability allows specially crafted emails to force a target’s device to connect to a remote URL and transmit the Windows user account’s Net-NTLMv2 hash. This exploit can grant unauthenticated attackers access to the target user’s Net-NTLMv2 hash, which can then be used to launch further attacks against another service in order to authenticate as the compromised user.
Further details will be provided as More information becomes available.
Affected Versions
This vulnerability has been reported to impact all supported versions of Microsoft Outlook for Windows however does not appear to affect Outlook for Android, iOS, or macOS versions of Outlook
Indicators of compromise
Microsoft have released a Powershell script to aid in investigations for potential compromise from this vulnerability. The script is available from the following URL and can be used in an audit only capacity or in a cleanup mode:
https://microsoft.github.io/CSS-Exchange/Security/CVE-2023-23397/
Remediation
In this week’s Patch Tuesday, Microsoft has released a critical security update for Microsoft Outlook. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397
References
- https://techcommunity.microsoft.com/t5/exchange-team-blog/released-march-2023-exchange-server-security-updates/ba-p/3764224#:~:text=under%20Product%20Family).-,Awareness%3A%20Outlook%20client%20update%20for%20CVE%2D2023%2D23397%20released,-There%20is%20a
- https://microsoft.github.io/CSS-Exchange/Security/CVE-2023-23397/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397
More like this
Swarm Intelligence: LiteLLM was the end of the chain, not the beginning.
LiteLLM’s PyPI package was backdoored for under an hour on March 24. SSH keys, cloud credentials, and CI/CD secrets exfiltrated at install. Here is what is…
Handala & MuddyWater: MDM Weaponization at Enterprise Scale
On 11 March 2026, an Iranian two-team operation destroyed 200,000 enterprise devices at Stryker without deploying a single piece of malware. One compromised Global Administrator account.…
Why Robbing Banks Is Easy (And Why That Should Terrify You)
A globally recognized ethical hacker shares real social engineering stories from legally robbing banks across five continents. The tools change. The human vulnerabilities don’t.