Microsoft disclosed and patched CVE-2023-23397, a critical elevation-of-privilege vulnerability in Outlook for Windows that had already been exploited in the wild. The flaw is notable because it requires no user interaction: a specially crafted message with an extended MAPI property pointing at an attacker-controlled UNC path triggers Outlook to authenticate to that remote share automatically, leaking the victim’s Net-NTLMv2 hash.
Why it matters for identity teams. A captured Net-NTLMv2 hash can be relayed to other services or cracked offline, giving an attacker a foothold under a legitimate user’s identity — without phishing, malware, or a click. It underscores why controlling and monitoring authentication flows (not just passwords) is foundational.
What to take away:
- Block outbound SMB (TCP 445) at the network edge to limit hash-leak channels.
- Audit privileged accounts for anomalous NTLM authentication.
- Apply identity-layer monitoring that can flag credential relay and offline-crack precursors.
This is a seed entry illustrating the Knowledge Center format. Read the full advisory at the primary source linked above.