CVE-2023-23397

What it actually does

CVE-2023-23397 is a no-interaction credential exposure/elevation-of-privilege flaw in Microsoft Outlook for Windows. A malicious message, calendar item, or task can contain crafted MAPI reminder properties that point the reminder sound file to an attacker-controlled UNC path. When Outlook processes the item, it attempts to retrieve the remote resource over SMB/WebDAV and automatically sends the user’s Net-NTLMv2 authentication material to the attacker. The attacker can then relay the NTLM authentication to other services or attempt offline cracking, enabling unauthorized access and potential privilege escalation without the victim opening or previewing the message.

Why it matters to the business

This vulnerability can expose employee Windows credentials simply by receiving a malicious Outlook item, creating a direct path to account compromise, lateral movement, data theft, and disruption of business operations. Because it is in CISA KEV, has a very high EPSS score, and has been exploited in the wild by Russian GRU-linked targeting of logistics and technology organizations, unpatched Outlook deployments should be treated as high-risk even though the issue was published in 2023 and the KEV remediation deadline has passed.

How an attack unfolds

An attacker creates an Outlook item with reminder-related MAPI properties that specify a remote UNC path such as an attacker-controlled SMB share. The attacker sends the item to a target mailbox. When the Windows Outlook client processes the item, Outlook resolves the reminder sound path and initiates an outbound authentication attempt to the attacker-controlled host. During that connection, the victim’s Net-NTLMv2 challenge-response is exposed. The attacker may relay the captured authentication to internal or external services that accept NTLM, or attempt to crack the hash offline. If successful, the attacker can access email, file shares, VPN, remote management services, or other domain-integrated systems using the compromised identity, then continue with discovery, privilege escalation, persistence, and data access. Reported exploitation has included Russian GRU-linked activity against Western logistics and technology targets.

How to fix it

Apply the Microsoft security updates released for CVE-2023-23397 to all affected Microsoft Outlook, Microsoft Office, Microsoft 365 Apps, and Office LTSC installations. Because no per-package fixed versions were provided in the input, use the latest supported channel/build for each installed Office product and verify it includes the March 2023 or later Outlook security fixes. Run Microsoft’s published CVE-2023-23397 mailbox scanning/remediation script or equivalent tooling to find and remove malicious or suspicious Outlook items containing UNC-based reminder properties, because malicious items may remain in mailboxes. Block outbound SMB traffic to the internet at network egress points, especially TCP 445 and 139, and restrict WebDAV/NTLM paths where feasible. Reduce NTLM exposure by enabling Extended Protection for Authentication where supported, enforcing SMB signing, restricting NTLM, disabling unnecessary WebClient/WebDAV usage, and placing high-value accounts in protections such as Protected Users where operationally feasible. Reset passwords or revoke sessions for accounts with evidence of NTLM exposure, especially privileged or high-value users.

How to confirm the fix worked

Confirm affected Office/Outlook installations are on patched builds from March 2023 or later and that Microsoft 365 Apps/Office update channels are current. Verify that mailbox scanning for CVE-2023-23397 has completed and that malicious or suspicious items with UNC-based reminder sound paths have been removed or neutralized. Test egress controls by confirming endpoints cannot initiate outbound SMB connections to untrusted internet hosts on TCP 445/139. Review endpoint and network telemetry to ensure Outlook is no longer initiating external SMB/WebDAV authentication attempts. Validate NTLM hardening by confirming unnecessary NTLM paths are disabled or restricted and that high-value accounts are protected from NTLM use where possible.

Typical attack path

1. Identify target organizations and users likely to use Microsoft Outlook for Windows with domain-integrated authentication.
2. Craft a malicious Outlook message, meeting invitation, or task containing reminder properties that reference an attacker-controlled UNC path.
3. Send the crafted item to the target mailbox; no opening or previewing by the user is required if Outlook processes the item.
4. Victim Outlook client attempts to access the remote reminder path and sends Net-NTLMv2 authentication material to the attacker-controlled server.
5. Capture the Net-NTLMv2 challenge-response over SMB/WebDAV.
6. Relay the authentication to a service that accepts NTLM or attempt offline password cracking.
7. Use the compromised identity to access email, file shares, remote services, or cloud/on-premises resources.
8. Perform lateral movement, privilege escalation, persistence, data collection, or exfiltration.

How to detect it

Hunt for both mailbox artifacts and network authentication evidence. In mailboxes, search messages, calendar items, and tasks for reminder properties that reference UNC paths or remote reminder sound files, especially PidLidReminderFileParameter combined with PidLidReminderOverride. Use Microsoft’s CVE-2023-23397 script output, Exchange mailbox audit logs, Microsoft 365 audit logs, and EWS/Graph item inspection where available. On endpoints, look for outlook.exe initiating outbound connections to external IPs or domains over SMB TCP 445/139 or WebDAV over HTTP/HTTPS, particularly around message delivery or reminder processing times. In network controls, review firewall, proxy, DNS, and IDS logs for outbound SMB attempts from user workstations to non-corporate addresses. In Windows telemetry, review SMBClient operational/connectivity logs, Windows security authentication events, EDR network events, and process network telemetry for Outlook-driven external authentication. If suspicious external NTLM exposure is found, investigate the associated mailbox items, preserve the item metadata, identify the user account involved, review subsequent authentication activity for relay or account misuse, and reset credentials where warranted. Include threat intelligence context for Russian GRU-linked campaigns when prioritizing logistics, transportation, technology, government, and defense-adjacent targets.

• PidLidReminderFileParameter
• PidLidReminderOverride
• ReminderFileParameter
• ReminderOverride
• \\
• outlook.exe
• OUTLOOK.EXE
• outlook.exe -> *:445
• OUTLOOK.EXE -> *:445
• outlook.exe -> *:139
• OUTLOOK.EXE -> *:139
• TCP/445 outbound from Outlook
• TCP/139 outbound from Outlook
• Microsoft-Windows-SMBClient/Connectivity
• Microsoft-Windows-SMBClient/Security
• Event ID 30803
• Event ID 30804
• Event ID 4624
• Event ID 4648
• Event ID 4776
• NTLMv2
• Net-NTLMv2
• CVE-2023-23397.ps1

What your security team should do

• Immediately confirm all Microsoft Outlook for Windows, Microsoft Office, Microsoft 365 Apps, and Office LTSC installations are patched; prioritize internet-connected and high-value user endpoints.
• Run Microsoft’s CVE-2023-23397 mailbox scanning/remediation script across mailboxes to identify and remove malicious items, not just patch endpoints.
• Block outbound SMB to the internet, especially TCP 445 and 139, and alert on any Outlook-initiated SMB/WebDAV connection attempts to external destinations.
• Hunt for historical exploitation using mailbox artifacts, Exchange/Graph audit data, endpoint telemetry, proxy logs, DNS logs, firewall logs, and SMB client events.
• Reset passwords and investigate accounts that generated suspicious external NTLM authentication attempts, prioritizing privileged users and users with access to sensitive systems.
• Reduce NTLM attack surface by enforcing SMB signing, enabling Extended Protection for Authentication where available, restricting NTLM, and protecting privileged accounts from NTLM authentication.
• Treat this as an active exploitation issue due to KEV status, high EPSS, and public reporting of Russian GRU-linked targeting; maintain detections even after patching.