Loading CVE intelligence

CVE-2023-23397

CriticalPublished

Microsoft Outlook Elevation of Privilege Vulnerability

Published: Mar 14, 2023
Updated: Oct 21, 2025
Assigning CNA: microsoft
Evidence observed: Mar 14, 2023

Primary CVSS

9.8/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

97.4%

High · next 30 days

Percentile: 99.9%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

CISA Known Exploited

This CVE appears in the CISA Known Exploited Vulnerabilities catalog.

Summary

Microsoft Outlook Elevation of Privilege Vulnerability

Sources

28

CVE-2023-23397-POC-PowershellPoC
PowerShell script to exploit CVE-2023-23397 by sending or saving malicious Outlook calendar invitations that trigger NTLM credential leakage via the ReminderSoundFile option.
CVE-2023-23397_EXPLOITPoC
Generates meeting requests taking advantage of CVE-2023-23397. This requires the outlook thick client to send.
cve-2023-23397Exploit
Python script for sending e-mails with CVE-2023-23397 payload using SMTP
CVE-2023-23397-PoC

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.

PoC

C# PoC exploit for CVE-2023-23397 that sends malicious Outlook meeting invites with a UNC path trigger for NTLM credential theft.

CVE-2023-23397PoC

PowerShell proof-of-concept for CVE-2023-23397 that exploits Outlook's ReminderSoundFile property to intercept Net-NTLMv2 hashes via SMB or WebDAV for credential relay attacks.

CVE-2023-23397PoC

CVE-2023-23397 C# PoC

OutlookNTLM_CVE-2023-23397Exploit

Exploit for CVE-2023-23397 Outlook NTLM hash leak via malicious calendar invitations. Includes PowerShell weaponization, Responder integration, and detection rules for incident response.

cve-2023-23397-purple-teamExploit

Purple team project exploiting CVE-2023-23397 Outlook NTLM leak with phishing delivery, plus Sigma/Wazuh detections mapped to MITRE ATT&CK for the attack chain.

CVE-2023-23397Patch

Patch for MS Outlook Critical Vulnerability - CVSS 9.8

CVE-2023-23397_EXPLOIT_0DAYExploit

Exploit for the CVE-2023-23397

CVE-2023-23397Research

CVE-2023-23397: Remote Code Execution Vulnerability in Microsoft Outlook

CVE-2023-23397-PoWExploit

Proof of Work of CVE-2023-23397 for vulnerable Microsoft Outlook client application.

CVE-2023-23397PoC

Proof of Concept for CVE-2023-23397 in Python

CVE-2023-23397PoC

Simple PoC of the CVE-2023-23397 vulnerability with the payload sent by email.

CVE-2023-23397PoC

CVE-2023-23397 PoC

cve-2023-23397-detection-labDetection

Detection and mitigation research lab for CVE-2023-23397 using network and endpoint security telemetry.

CVE-2023-23397-POCPoC

Exploit POC for CVE-2023-23397

CVE-2023-23397-POC-Using-Interop-OutlookPoC

Proof-of-concept exploit for CVE-2023-23397 using Microsoft.Office.Interop.Outlook to trigger the vulnerability and demonstrate exploitation.

CVE-2023-23397PoC

CVE-2023-23397 - Microsoft Outlook Vulnerability

CVE-2023-23397-ReportPoC

An exploitation demo of Outlook Elevation of Privilege Vulnerability

CVE-2023-23397Exploit

Demonstration of CVE-2023-23397 Outlook Privellege Escalation vulnerability

CVE-2023-23397Exploit

Python script to create a message with the vulenrability properties set

CVE-2023-23397Patch

PowerShell script to detect and remediate CVE-2023-23397 privilege escalation vulnerability in Microsoft Outlook and Exchange environments.

CVE-2023-23397PoC

Proof-of-concept exploit for CVE-2023-23397, an Outlook/Exchange privilege escalation vulnerability that triggers NTLM credential theft via a malicious calendar invitation.

CVE-2023-23397PoC

Proof-of-concept exploit for CVE-2023-23397, a Microsoft Outlook privilege escalation vulnerability. Sends a crafted email with a malicious UNC path to trigger NTLM credential theft for security testing.

CVE-2023-23397-POCPoC

CVE-2023-23397漏洞的简单PoC，有效载荷通过电子邮件发送。

CVE-2023-23397-POCPoC

Two POCs I created for the CVE-2023-23397 Outlook NTLM vulnerability, to be used internally.

CVE-2023-23397Exploit

This script exploits CVE-2023-23397, a Zero-Day vulnerability in Microsoft Outlook, allowing the generation of malicious emails for testing and educational purposes.