KB5002254: Windows 10, Windows 11 +3 more Security Update (March 2023)
A specially crafted calendar invite forces Outlook to connect to an attacker's SMB server and leak NTLMv2 credentials — no user interaction required. Apply KB5023745 immediately; exploited by APT28 (Russia) since at least April 2022.
An attacker who receives a target's NTLMv2 hash can relay it for lateral movement or crack it offline. For domain accounts, the hash can be used in pass-the-hash attacks, granting access to network shares, Exchange mailboxes, and other systems. No user action is needed — the attack fires when the email arrives.
Outlook processes a calendar item's "UNC_PATH" reminder sound property before the item is opened. If this path points to an attacker-controlled server, Windows automatically sends NTLMv2 authentication — leaking the user's credential hash without any clicks. Email preview in the Reading Pane is sufficient to trigger the attack.
📧
Phishing link
🖼
Malicious file
🔓
Server compromised
Probably yes if any of these apply:
Affected OS versions
Microsoft attributed active exploitation to Forest Blizzard (APT28), a Russian GRU-affiliated threat actor. The group used CVE-2023-23397 to target European organisations in the energy, transportation, and government sectors beginning in April 2022, nearly a year before the vulnerability was disclosed. The attack was used for initial access and credential harvesting in multi-stage intrusions.
Manual download
For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.
↗ Microsoft Update CatalogKB5002254Manual remediation steps
⏱ 15 minutes (Office update, no reboot required)Apply the Microsoft Security Update
Microsoft has released an official security update that fixes this vulnerability.
Required KB Updates
Supersedes: KB5001990, KB5002051
Affected Products
Fixed Build Numbers
Installation Methods
Windows Update (recommended)
Microsoft Update Catalog (manual download)
.msu installer with administrator privilegesWSUS / SCCM / Intune
Approve KB5002254 for the affected products in your update management console.
Microsoft Download Center Links
Verification
Confirm the update is installed:
Get-HotFix | Where-Object { $_.HotFixID -in @('KB5002254','KB5002265') }
References
Discovery Credit
CERT-UA, Microsoft Incident Response, Microsoft Threat Intelligence
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
| Patch ID | CVE ID | Vulnerability Name / Type | CVSS | Reference |
|---|---|---|---|---|
| KB5002254 | CVE-2023-23397 | Microsoft Outlook (Windows client) | 9.8 | NVD ↗ |