← Knowledge Center
Zero-Day CVE-2023-23397

Outlook elevation-of-privilege flaw leaks NTLM credentials with no user interaction

Microsoft disclosed and patched CVE-2023-23397, a critical elevation-of-privilege vulnerability in Outlook for Windows that had already been exploited in the wild. The flaw is notable because it requires no user interaction: a specially crafted message with an extended MAPI property pointing at an attacker-controlled UNC path triggers Outlook to authenticate to that remote share automatically, leaking the victim’s Net-NTLMv2 hash.

Why it matters for identity teams. A captured Net-NTLMv2 hash can be relayed to other services or cracked offline, giving an attacker a foothold under a legitimate user’s identity — without phishing, malware, or a click. It underscores why controlling and monitoring authentication flows (not just passwords) is foundational.

What to take away:

  • Block outbound SMB (TCP 445) at the network edge to limit hash-leak channels.
  • Audit privileged accounts for anomalous NTLM authentication.
  • Apply identity-layer monitoring that can flag credential relay and offline-crack precursors.

This is a seed entry illustrating the Knowledge Center format. Read the full advisory at the primary source linked above.

Primary source

Microsoft Security Response Center

Read at msrc.microsoft.com ↗

Summary by AD Argus. We publish our own analysis with attribution and a link to the original report; always consult the primary source for authoritative detail.