KB5023745: Microsoft Outlook 2016 / 2019 / 365 Security Update (March 2023)
A specially crafted calendar invite forces Outlook to connect to an attacker's SMB server and leak NTLMv2 credentials — no user interaction required. Apply KB5023745 immediately; exploited by APT28 (Russia) since at least April 2022.
An attacker who receives a target's NTLMv2 hash can relay it for lateral movement or crack it offline. For domain accounts, the hash can be used in pass-the-hash attacks, granting access to network shares, Exchange mailboxes, and other systems. No user action is needed — the attack fires when the email arrives.
Outlook processes a calendar item's "UNC_PATH" reminder sound property before the item is opened. If this path points to an attacker-controlled server, Windows automatically sends NTLMv2 authentication — leaking the user's credential hash without any clicks. Email preview in the Reading Pane is sufficient to trigger the attack.
📧
Phishing link
🖼
Malicious file
🔓
Server compromised
Probably yes if any of these apply:
Affected OS versions
Microsoft attributed active exploitation to Forest Blizzard (APT28), a Russian GRU-affiliated threat actor. The group used CVE-2023-23397 to target European organisations in the energy, transportation, and government sectors beginning in April 2022, nearly a year before the vulnerability was disclosed. The attack was used for initial access and credential harvesting in multi-stage intrusions.
Manual download
For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.
↗ Microsoft Update CatalogKB5023745Manual remediation steps
⏱ 15 minutes (Office update, no reboot required)Check if Outlook is Patched
# For Click-to-Run (Microsoft 365 Apps)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" | Select UpdateChannel, VersionToReport
# Must be >= 16.0.16130.20306 (Current Channel)
# For MSI installations, check Add/Remove Programs or:
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\AddinsConfig" 2>$null
Immediate Workaround (if patching delayed)
# Block outbound SMB at the firewall (TCP 445, UDP 137-138, TCP 139)
# This prevents NTLM relay but may impact legitimate SMB traffic
New-NetFirewallRule -DisplayName "Block Outbound SMB" -Direction Outbound `
-Protocol TCP -RemotePort 445 -Action Block
Apply the Update
Verify (Check Outlook version after update)
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
| Patch ID | CVE ID | Vulnerability Name / Type | CVSS | Reference |
|---|---|---|---|---|
| KB5023745 | CVE-2023-23397 | Microsoft Outlook (Windows client) | 9.8 | NVD ↗ |