{"id":"CVE-2023-23397","published":"2023-03-14T17:15:13Z","modified":"2026-06-17T05:37:01Z","title":"Microsoft Office Outlook Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Office","tier":"core","eol":null,"description":{"text":"Microsoft Outlook Elevation of Privilege Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a privilege escalation vulnerability in Microsoft Outlook, a component of Microsoft Office. An attacker who exploits it can gain elevated privileges, and the vector indicates it is reachable over the network with low complexity, requiring no privileges and no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:48Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.97159,"percentile":0.99894,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-03-14","dueDate":"2023-04-04","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-23397, https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/, ;  https://nvd.nist.gov/vuln/detail/CVE-2023-23397","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-03-14","exploitedFirstSeen":"2023-03-14","ransomware":true,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2023-Mar","date":"2023-03-14"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2023-03-14"},{"url":"https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/","date":"2023-03-14"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-03-14"},{"url":"https://www.deepinstinct.com/blog/cve-2023-23397-exploitations-in-the-wild-what-you-need-to-know","date":"2023-03-16"},{"url":"https://www.mandiant.com/resources/blog/zero-days-exploited-2022","date":"2023-03-20"},{"url":"https://ti.qianxin.com/blog/articles/Analysis-of-In-the-wild-Attack-Samples-Exploiting-Outlook-Privilege-Escalation-Vulnerability-(CVE-2023-23397)-EN/","date":"2023-03-29"},{"url":"https://blog.sekoia.io/apt28-leverages-multiple-phishing-techniques-to-target-ukrainian-civil-society/","date":"2023-05-17"},{"url":"https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers","date":"2023-06-20"},{"url":"https://securelist.com/analysis-of-attack-samples-exploiting-cve-2023-23397/110202/","date":"2023-07-19"}],"evidenceTotal":63,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-294","name":"Authentication Bypass by Capture-replay"},{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397","tags":["Patch","Vendor Advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-23397","tags":["US Government Resource"]}],"techniques":[{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited when an adversary sends a specially-crafted email which can result in the disclosure of authentication information that an adversary can replay to gain access to systems.","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1550.002","name":"Pass the Hash","tactics":["lateral-movement"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited when an adversary sends a specially-crafted email which can result in the disclosure of authentication information that an adversary can replay to gain access to systems.","confidence":"high"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited when an adversary sends a specially-crafted email which can result in the disclosure of authentication information that an adversary can replay to gain access to systems.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-27497","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-27497","exploited":true,"exploitedSince":"2023-03-14","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":27,"skipped":2,"earliest":"2023-03-15","earliestUrl":"https://github.com/sqrtZeroKnowledge/CVE-2023-23397_EXPLOIT_0DAY","repos":[{"name":"api0cradle/CVE-2023-23397-POC-Powershell","url":"https://github.com/api0cradle/CVE-2023-23397-POC-Powershell","stars":344,"created":"2023-03-16"},{"name":"sqrtZeroKnowledge/CVE-2023-23397_EXPLOIT_0DAY","url":"https://github.com/sqrtZeroKnowledge/CVE-2023-23397_EXPLOIT_0DAY","stars":158,"created":"2023-03-15"},{"name":"Trackflaw/CVE-2023-23397","url":"https://github.com/Trackflaw/CVE-2023-23397","stars":132,"created":"2023-03-20"},{"name":"ka7ana/CVE-2023-23397","url":"https://github.com/ka7ana/CVE-2023-23397","stars":40,"created":"2023-03-16"},{"name":"tiepologian/CVE-2023-23397","url":"https://github.com/tiepologian/CVE-2023-23397","stars":25,"created":"2023-03-21"}]},"first":{"date":"2023-03-15","source":"PoC-in-GitHub","url":"https://github.com/sqrtZeroKnowledge/CVE-2023-23397_EXPLOIT_0DAY"},"provenance":"source"},"detections":{"cveRules":[{"title":"CVE-2023-23397 Exploitation Attempt","id":"73c59189-6a6d-4b9f-a748-8f6f9bbed75c","level":"critical","status":"test","path":"rules-emerging-threats/2023/Exploits/CVE-2023-23397/win_security_exploit_cve_2023_23397_outlook_remote_file_query.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-23397/win_security_exploit_cve_2023_23397_outlook_remote_file_query.yml","techniques":[]},{"title":"Suspicious WebDav Client Execution Via Rundll32.EXE","id":"982e9f2d-1a85-4d5b-aea4-31f5e97c6555","level":"high","status":"test","path":"rules/windows/process_creation/proc_creation_win_rundll32_webdav_client_susp_execution.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_webdav_client_susp_execution.yml","techniques":["T1048.003"]},{"title":"Potential CVE-2023-23397 Exploitation Attempt - SMB","id":"de96b824-02b0-4241-9356-7e9b47f04bac","level":"medium","status":"test","path":"rules-emerging-threats/2023/Exploits/CVE-2023-23397/win_smbclient_connectivity_exploit_cve_2023_23397_outlook_remote_file.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-23397/win_smbclient_connectivity_exploit_cve_2023_23397_outlook_remote_file.yml","techniques":[]},{"title":"Outlook Task/Note Reminder Received","id":"fc06e655-d98c-412f-ac76-05c2698b1cb2","level":"low","status":"test","path":"rules-emerging-threats/2023/Exploits/CVE-2023-23397/registry_set_exploit_cve_2023_23397_outlook_reminder_trigger.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-23397/registry_set_exploit_cve_2023_23397_outlook_reminder_trigger.yml","techniques":["T1137"]}]},"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1550.002"],"provenance":"source"},{"stage":"secondary","techniques":["T1078"],"provenance":"source"},{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2023-03-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23397","provenance":"source"},{"date":"2023-03-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2023-Mar","provenance":"source"},{"date":"2023-03-14","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-03-14","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-27497","provenance":"source"},{"date":"2023-03-15","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/sqrtZeroKnowledge/CVE-2023-23397_EXPLOIT_0DAY","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1325 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9989"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"27 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-office-cwe-20"}}