CVE-2023-35311

What it actually does

CVE-2023-35311 is a Microsoft Outlook security feature bypass that can allow a specially crafted message, attachment, or link to evade Outlook’s normal safety prompts or protections when a user interacts with the malicious content. At a technical level, successful exploitation requires user interaction and favorable timing/conditions, but can result in Outlook processing attacker-controlled content in a way that exposes sensitive data, enables further code execution chains, or bypasses controls intended to warn users before accessing unsafe external resources. The vulnerability affects Microsoft Outlook, Microsoft Office, and Microsoft 365 Apps and has been observed exploited in the wild.

Why it matters to the business

An attacker can use this flaw in phishing or targeted email operations to make malicious Outlook content more likely to succeed by bypassing built-in user warnings. For organizations, this increases the risk of credential theft, malware delivery, lateral movement, and compromise of email users or endpoints. Because it is listed in CISA’s Known Exploited Vulnerabilities catalog with a remediation due date of 2023-08-01 and exploitation has been observed in the wild, unpatched Outlook deployments should be treated as a priority exposure even though exploitation requires user interaction.

How an attack unfolds

An attacker prepares a malicious email, calendar item, attachment, or embedded link designed to trigger the Outlook security feature bypass. The attacker delivers the content to a target mailbox through phishing, spear-phishing, or another email delivery path. When the user previews, opens, or clicks the crafted content, Outlook may fail to present the expected security warning or may process an external resource in an unsafe way. The bypass can then be used as part of a broader intrusion chain, such as causing the client to authenticate to attacker-controlled infrastructure, opening attacker-controlled content, or enabling follow-on exploitation through Office, Windows, or credential-theft techniques. Because exploitation is known in the wild, defenders should assume threat actors may combine this issue with social engineering and post-exploitation tooling rather than use it as a standalone payload.

How to fix it

Apply Microsoft security updates for Outlook, Microsoft Office, and Microsoft 365 Apps released in July 2023 or later, and keep Click-to-Run and MSI-based Office installations on currently supported patched builds. Where exact fixed versions are not centrally available, use Microsoft Update, Microsoft 365 Apps update channels, WSUS, Intune, Configuration Manager, or enterprise software management tooling to bring all affected Outlook clients to a fully current build. Remove or upgrade unsupported Office versions. As compensating controls, harden email security controls, block or warn on suspicious external links and attachments, restrict outbound SMB/WebDAV exposure where feasible, disable automatic processing of risky external content, and reinforce phishing-resistant authentication and endpoint detection controls.

How to confirm the fix worked

Confirm that all affected endpoints have received Microsoft Office/Outlook security updates from July 2023 or later and are on supported patched builds. Validate Microsoft 365 Apps update channel compliance through inventory tooling, Microsoft 365 Apps admin center, Intune, Configuration Manager, WSUS, or endpoint management reports. On individual systems, verify the installed Outlook/Office build and update history, then compare it with Microsoft’s release notes for the relevant servicing channel. Test email security controls with benign messages containing external file links, UNC-style paths, and suspicious embedded URLs to ensure they are blocked, rewritten, or alerted as intended. Confirm that egress controls restrict unnecessary outbound SMB traffic to the Internet.

Typical attack path

1. Identify organizations or users likely to run vulnerable Microsoft Outlook, Office, or Microsoft 365 Apps clients.
2. Craft an Outlook-delivered item such as an email, meeting invite, attachment, or embedded link that triggers the security feature bypass.
3. Send the item to the target through phishing or spear-phishing infrastructure.
4. Wait for the user to preview, open, or click the crafted content in Outlook.
5. Bypass the expected Outlook security prompt or protection.
6. Use the resulting access path to obtain sensitive data, capture authentication material, launch additional payloads, or continue the compromise through other vulnerabilities and tooling.

How to detect it

To determine whether this vulnerability may already have been exploited, review email gateway, Microsoft 365 Defender, Exchange, endpoint, proxy, DNS, firewall, and EDR telemetry around suspicious Outlook-delivered content. Look for inbound messages or calendar items containing external file references, UNC paths, WebDAV links, file:// URLs, or links that cause Outlook or Office to access attacker-controlled infrastructure. On endpoints, hunt for Outlook initiating unusual outbound network connections, especially to unknown SMB, WebDAV, or HTTP/S destinations, and for suspicious child processes spawned by Outlook or other Office applications. Correlate user interaction time with subsequent authentication events, NTLM authentication attempts, credential prompts, file downloads, process creation, and remote connections. Because this is a security feature bypass rather than a payload with a single universal artifact, detection should focus on exploit delivery patterns and follow-on behavior. Pay particular attention to activity before patch deployment and to users who received suspicious emails shortly before endpoint alerts or unusual outbound authentication attempts.

• file://
• file:///
• \\
• \\@
• @SSL\DavWWWRoot
• DavWWWRoot
• http://*/DavWWWRoot
• https://*/DavWWWRoot
• outlook.exe spawning powershell.exe
• outlook.exe spawning cmd.exe
• outlook.exe spawning wscript.exe
• outlook.exe spawning cscript.exe
• outlook.exe spawning mshta.exe
• outlook.exe spawning rundll32.exe
• outlook.exe spawning regsvr32.exe
• outlook.exe outbound connection to TCP/445
• outlook.exe outbound connection to TCP/139
• outlook.exe outbound connection to TCP/80 with WebDAV
• outlook.exe outbound connection to TCP/443 with WebDAV
• NTLMSSP_NEGOTIATE from outlook.exe
• NTLMSSP_AUTH from outlook.exe

What your security team should do

• Prioritize patch verification for all Outlook, Microsoft Office, and Microsoft 365 Apps clients because this vulnerability is in the CISA KEV catalog and exploitation has been observed in the wild.
• Use endpoint management inventory to identify unpatched or unsupported Office installations and remediate them before lower-risk software defects.
• Review email security telemetry for phishing messages containing external file paths, UNC links, WebDAV references, suspicious attachments, or links designed to open content in Office applications.
• Hunt for unusual outbound authentication or file-access attempts from user workstations shortly after Outlook activity, especially SMB, WebDAV, or HTTP/S connections to unfamiliar infrastructure.
• Block outbound SMB to the Internet and restrict WebDAV where operationally feasible to reduce the impact of Outlook-based credential exposure or remote resource abuse.
• Ensure endpoint detection and response tools monitor Outlook child processes, Office-spawned scripting interpreters, archive utilities, and network connections to untrusted destinations.
• Reinforce user reporting and phishing response workflows, since exploitation depends on user interaction with attacker-controlled Outlook content.