CVE-2023-36761

What it actually does

This vulnerability allows a specially crafted Microsoft Word or Office document to disclose sensitive information when a user opens or previews it. The most important practical impact is leakage of authentication material, such as NTLM credentials or hashes, to an attacker-controlled network location referenced by the document. Exploitation requires user interaction, but no attacker authentication is required, and the confidentiality impact is high because the disclosed credential material can support follow-on authentication attempts, relay attacks, or offline password cracking.

Why it matters to the business

Successful exploitation can expose employee authentication material simply through interaction with a malicious Office document, enabling attackers to move from phishing to credential abuse, internal access, or lateral movement. Because this vulnerability is in CISA KEV, has active in-the-wild exploitation, and the federal remediation deadline was 2023-10-03, unpatched systems should be treated as high-priority exposure even though the CVSS score is medium. Organizations using Microsoft Word, Microsoft Office, Microsoft 365 Apps, or Office LTSC broadly may have substantial operational exposure due to the prevalence of Office document workflows.

How an attack unfolds

An attacker prepares a malicious Word or Office document that contains an external reference, template, relationship, or embedded resource designed to cause Word or the Office preview handler to reach out to attacker-controlled infrastructure. The attacker delivers the file through phishing, a file-sharing link, a compromised mailbox, or a collaboration platform. When the target opens or previews the document, Word attempts to resolve the external resource over protocols such as SMB, WebDAV, or HTTP-based Office retrieval paths. During that connection, Windows may automatically offer NTLM authentication material to the remote server. The attacker captures the disclosed credential material and can then attempt NTLM relay, password cracking, or targeted reuse against exposed services. This vulnerability has been reported as actively exploited in the wild, so suspicious Office-document-triggered outbound authentication should be investigated as potential compromise, not just attempted exploitation.

How to fix it

Apply the Microsoft security updates that address CVE-2023-36761 across all affected Microsoft Word, Microsoft Office, Microsoft 365 Apps, and Office LTSC installations. Because no fixed versions were provided in the input, use the applicable Microsoft Update channel, Microsoft 365 Apps update channel, Office LTSC patch baseline, or enterprise software-management catalog to verify that September 2023 or later security updates for Office are installed. Prioritize internet-facing, high-risk, executive, finance, legal, HR, and helpdesk workstations because these users are common document-phishing targets. As compensating controls, restrict outbound SMB/WebDAV traffic to the internet, block NTLM authentication to untrusted destinations where feasible, harden Office Protected View and Attack Surface Reduction rules, disable automatic external content retrieval where operationally possible, and ensure mail/web gateways inspect Office documents for external template or relationship references.

How to confirm the fix worked

Confirm that all affected Office products are updated to a build containing the September 2023 Microsoft Office security fixes or later. Validate through enterprise patch inventory, Microsoft 365 Apps admin center reporting, endpoint management tooling, or local Office build checks. Test that representative systems no longer trigger unintended outbound authentication when opening controlled benign documents that contain external Office references. Validate network controls by confirming that outbound SMB ports 445 and 139, and unauthorized WebDAV/NTLM authentication to external hosts, are blocked or alerted. Review endpoint telemetry to ensure Word preview/open operations are logged sufficiently to detect WINWORD.EXE or Office preview handlers initiating unusual network connections.

Typical attack path

1. Attacker identifies an organization likely to use Microsoft Word or Office document workflows.
2. Attacker crafts a malicious Word/Office document containing an external reference that causes Word or an Office component to connect to attacker-controlled infrastructure.
3. Attacker delivers the document through phishing email, shared storage, a collaboration message, or a link to a hosted file.
4. User opens or previews the document in Microsoft Word, Microsoft Office, Microsoft 365 Apps, or Office LTSC.
5. Word or an Office preview component initiates an outbound connection to retrieve the referenced remote resource.
6. The target system discloses sensitive authentication information, commonly NTLM authentication material, to the attacker-controlled endpoint.
7. Attacker uses the captured material for NTLM relay, offline cracking, account targeting, or additional intrusion attempts.

How to detect it

Investigate whether this was already exploited by correlating email, web, endpoint, authentication, and network telemetry around suspicious Office document activity. Start with mail gateway and EDR records for inbound Word/Office attachments or links followed by WINWORD.EXE, Office preview handlers, or Explorer preview activity. Review network logs, proxy logs, firewall logs, DNS logs, and EDR network events for Microsoft Office processes initiating outbound SMB, WebDAV, or unusual HTTP/HTTPS connections to external or newly observed domains and IP addresses, especially immediately after a document was opened. Search Windows security logs and domain controller logs for NTLM authentication anomalies, including outbound NTLM to non-corporate hosts, failed or successful NTLM authentication from unexpected sources, and follow-on authentication attempts using the same user account. Examine suspicious .docx/.docm/.rtf files by unpacking Office Open XML content and reviewing relationship files for external targets, UNC paths, remote templates, file:// paths, WebDAV URLs, or mhtml/ms-word style handlers. If credential leakage is suspected, perform account-focused investigation for NTLM relay, impossible travel, new service access, lateral movement, password-spraying, or subsequent mailbox and VPN activity.

• WINWORD.EXE
• word/_rels/document.xml.rels
• word/_rels/settings.xml.rels
• TargetMode="External"
• file://
• \\
• mhtml:
• ms-word:
• template.dotm
• attachedTemplate
• DavWWWRoot
• WebClient
• Microsoft Office Alerts
• Logon Type 3
• Package Name (NTLM only): NTLM
• Event ID 4776
• Event ID 4624
• Event ID 4625
• Event ID 7040
• DestinationPort=445
• DestinationPort=139
• Image=WINWORD.EXE

What your security team should do

• Immediately identify systems running Microsoft Word, Microsoft Office, Microsoft 365 Apps, or Office LTSC that have not received the September 2023 or later Office security updates.
• Prioritize remediation because the vulnerability is in CISA KEV, exploitation is active in the wild, and the KEV remediation due date has passed.
• Block outbound SMB to the internet and restrict NTLM authentication to untrusted destinations to reduce credential-leak and relay risk.
• Deploy or verify Microsoft Defender Attack Surface Reduction and Office hardening policies that reduce malicious document execution and external content abuse.
• Hunt for historical instances of WINWORD.EXE, Office preview handlers, or related Office processes making outbound SMB, WebDAV, or unusual HTTP connections immediately after document access.
• Inspect suspicious Office documents for external relationships, remote templates, UNC paths, file:// references, and attacker-controlled URLs.
• Treat any confirmed credential disclosure as a credential incident: reset affected passwords, revoke sessions where applicable, review authentication logs, and investigate for relay or lateral movement.
• Add SIEM detections for Office processes initiating network connections to non-corporate destinations, especially on ports 445, 139, 80, and 443 with NTLM authentication indicators.