BSI warns: exploitation of a vulnerability in MS Outlook

B2B Cyber ​​Security ShortNews

Share post

The BSI warns of a vulnerability in Outlook that is apparently already being actively exploited. The CVSS value of the vulnerability is 9.8 and is therefore considered critical. Microsoft is already providing an update that should be installed immediately if it didn't happen automatically.

On March 14, 2023, Microsoft released updates for numerous vulnerabilities as part of its monthly Patch Days - including several patches for security vulnerabilities that are classified as "critical" according to the Common Vulnerability Scoring System (CVSS) with values ​​of 9.0 and higher.


Important patch ready

The publications include: the patch for a "Microsoft Outlook Elevation of Privilege Vulnerability" (CVE-2023-23397; CVSS score 9.8), where the company indicates that the vulnerability is already being actively exploited. According to this, attackers could use a manipulated e-mail to intercept Net-NTLMv2 hashes. The attack already occurs when the e-mail is processed on the e-mail server - no action by the recipient is necessary. All versions of Outlook for Windows are affected. More information can be found in Microsoft's blog post.

More critical vulnerabilities with 9.8 out of 10

Microsoft lists the following vulnerabilities as rated with the highest CVSS scores, but not yet actively exploited according to the current state of knowledge:


  • HTTP Protocol Stack Remote Code Execution Vulnerability (CVE-2023-23392; CVSS score 9.8): A vulnerability in primarily Windows Server 2022 if the HTTP/3 protocol is enabled.
  • Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVE-2023-21708; CVSS Score 9.8): Affected are Windows servers whose port 135 (RPC Endpoint Mapper) can be reached.
  • Internet Control Message Protocol (ICMP) Remote Code Execution Vulnerability (CVE-2023-23415; CVSS score 9.8): If an application on the system uses raw sockets, code could be executed remotely on the system using manipulated IP packets.

IT security officers should check the installation of the published patches promptly. The mitigation of the “Microsoft Outlook Elevation of Privilege Vulnerability” (CVE-2023-23397) described above should be pursued with particular priority due to the exploitation that has already been observed. In addition, we strongly recommend that you also check the other updates at short notice. Although there are no known attacks here, the manufacturer assumes that there is a high probability that these will take place.

According to Microsoft, attackers can use the Net-NTLMv2023 hashes obtained by exploiting CVE-23397-2 for NTLM relay attacks. NTLM relay attacks can be mitigated by activating strict SMB and LDAP signing, Extended Protection for Authentication (EPA) or ideally by completely disabling NTLM authentication. Microsoft provides a script to investigate whether an attack on its own systems has already taken place.

More at


About Microsoft Germany

Microsoft Deutschland GmbH was founded in 1983 as the German subsidiary of Microsoft Corporation (Redmond, USA). Microsoft is committed to empowering every person and company in the world to achieve more. This challenge can only be mastered together, which is why diversity and inclusion have been firmly anchored in the corporate culture from the very beginning.

As the world's leading manufacturer of productive software solutions and modern services in the age of intelligent cloud and intelligent edge, as well as a developer of innovative hardware, Microsoft sees itself as a partner to its customers to help them benefit from the digital transformation. Security and data protection have top priority when developing solutions. As the world's largest contributor, Microsoft is driving open source technology through its leading developer platform GitHub. With LinkedIn, the largest career network, Microsoft promotes professional networking worldwide.


Matching articles on the topic

Attacked vulnerability in Samsung smartphones running Android 12, 13

One of the vulnerabilities that Samsung's May update closes is even reported by the CISA - Cybersecurity and Infrastructure Security Agency ➡ Read more

Bitmarck & health insurance companies: There are still failures

More than 2 months ago, the IT provider for dozens of health insurance companies and company health insurance companies, Bitmarck, was hit by a cyber attack. Even whole had to ➡ Read more

Ransomware Report: LockBit targets macOS

LockBit, currently the most active ransomware group, expanded its activities to macOS devices in April. Furthermore, vulnerabilities in the PaperCut printer software become active ➡ Read more

AOK: Software vulnerability - BSI confirms data leak

The AOK and many of their nationwide offices use the software product MOVEit Transfer. There is now the dangerous vulnerability CVE-2023-34362, ➡ Read more

China malware: Volt Typhoon targets critical US infrastructure

Microsoft investigated the Volt Typhoon malware and determined that it was created by a state-sponsored actor based in China ➡ Read more

COSMICENERGY: OT malware is designed to cause power outages

Mandiant is reporting a new specialized Operational Technology (OT) malware being observed under the name COSMICENERGY. The malware ➡ Read more

Lockbit steals 700 GB of data from MCNA with 9 million customers

MCNA Dental, North America's largest dental insurer, has had to inform all of its nearly 9 million customers at a loss of 700 ➡ Read more

Zero Trust: Advanced User Intelligence

A Zero Trust Data Security company presents its Advanced User Intelligence. The new functions support companies in preventing cyber attacks ➡ Read more