CVE-2023-23397Outlook reminder leaks Net-NTLMv2 hashes with no click

What broke

Outlook for Windows honored PidLidReminderFileParameter on a meeting. An attacker set that property to a UNC path they controlled. When the reminder fired, Outlook authenticated to the share and sent a Net-NTLMv2 hash. No click, no preview pane. All supported Outlook-for-Windows builds, including Microsoft 365. Exploited as a zero-day. CISA KEV. Patched 14 March 2023.

Why it matters

NTLM hashes are still passwords in many forests. A calendar invite that steals them is an identity incident that starts in email. Russian state actors used it. Identity teams who had "we blocked NTLM outbound" as a control found out who actually had that control.

What to do

• Deploy the March 2023 Outlook updates. Hunt for messages that set PidLidReminderFileParameter (Microsoft published a script).
• Block outbound SMB/WebDAV from workstations. Disable NTLM where you can.
• If hashes could have left the network, treat them as compromised passwords: reset, and look for later use.

After you patch

Patching an authentication bypass stops new intrusions. It does not evict anyone already inside, and that is the step most teams skip.

• Revoke every session and refresh token, not just the passwords. A session issued before the patch is still valid after it.
• Enumerate accounts created or modified during the exposure window, including local accounts on the appliance itself, service accounts, and API tokens.
• Remove authentication methods you did not add. An attacker with administrative access enrols a factor so the access survives your remediation.
• Rotate every credential the compromised system could reach: directory service accounts used for user lookup, integration keys, and anything in its configuration store. See secrets rotation.
• Assume the device is a pivot, not a destination. Check what it could authenticate to and treat that as in scope.

Sources

• NVD: CVE-2023-23397
• CISA KEV
• Huntress / Microsoft guidance, March 2023