CVEvulnerability

CVE-2023-23397

9.8 CRITICAL Known exploited Published 2023-03-14 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Microsoft Office Outlook Privilege Escalation Vulnerability — Microsoft Office

Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.

Added to KEV
2023-03-14
Remediation due
2023-04-04
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-23397, https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/, ; https://nvd.nist.gov/vuln/detail/CVE-2023-23397
Status
Analyzed
Published
2023-03-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-294

Description

Microsoft Outlook Elevation of Privilege Vulnerability

Affected configurations

• microsoft 365 apps • microsoft office 2019 • microsoft office long term servicing channel 2021 • microsoft outlook 2013 • microsoft outlook 2016

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-294 Authentication Bypass by Capture-replay weakness

References