CVE-2023-23397Outlook reminder leaks Net-NTLMv2 hashes with no click
What broke
Outlook for Windows honored PidLidReminderFileParameter on a meeting. An attacker set that property to a UNC path they controlled. When the reminder fired, Outlook authenticated to the share and sent a Net-NTLMv2 hash. No click, no preview pane. All supported Outlook-for-Windows builds, including Microsoft 365. Exploited as a zero-day. CISA KEV. Patched 14 March 2023.
Why it matters
NTLM hashes are still passwords in many forests. A calendar invite that steals them is an identity incident that starts in email. Russian state actors used it. Identity teams who had "we blocked NTLM outbound" as a control found out who actually had that control.
What to do
- Deploy the March 2023 Outlook updates. Hunt for messages that set
PidLidReminderFileParameter(Microsoft published a script). - Block outbound SMB/WebDAV from workstations. Disable NTLM where you can.
- If hashes could have left the network, treat them as compromised passwords: reset, and look for later use.
After you patch
Patching an authentication bypass stops new intrusions. It does not evict anyone already inside, and that is the step most teams skip.
- Revoke every session and refresh token, not just the passwords. A session issued before the patch is still valid after it.
- Enumerate accounts created or modified during the exposure window, including local accounts on the appliance itself, service accounts, and API tokens.
- Remove authentication methods you did not add. An attacker with administrative access enrols a factor so the access survives your remediation.
- Rotate every credential the compromised system could reach: directory service accounts used for user lookup, integration keys, and anything in its configuration store. See secrets rotation.
- Assume the device is a pivot, not a destination. Check what it could authenticate to and treat that as in scope.
Sources
- NVD: CVE-2023-23397
- CISA KEV
- Huntress / Microsoft guidance, March 2023
Related identity CVEs
Related on Start with Identity
- BlogRemote access appliances are credential vaults, so patch day has to be rotation day
Four October disclosures about BeyondTrust, Ivanti and Fortinet gateways all ended the same way: the attacker left with the credentials the box was holding. A p
- CVEBeyondTrust Remote Support pre-auth command injection, a variant of CVE-2024-12356
An unauthenticated request could run operating system commands on self-hosted BeyondTrust Remote Support and older Privileged Remote Access appliances. Scanning
- CVECommvault Web Server zero-day that exposed Metallic Microsoft 365 app secrets
An authenticated webshell flaw in Commvault Web Server, used as a zero-day in Commvault's Azure environment, where the actor may have reached client secrets cus
- CVEJetBrains TeamCity 2023 authentication bypass to RCE
Unauthenticated request becomes administrator, then code execution, on TeamCity On-Premises before 2023.05.4. CVSS 9.8. CISA KEV. Used by Russian state actors.
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- BlogAccess broker k0t breached FortiGate and GlobalProtect edges and exposed more than 70,000 credentials
Group-IB and NyxLab reported on October 21 that k0t, a likely initial access broker, broke into Fortinet and Palo Alto edge devices with known CVEs and brute fo