KB5023706: Windows Server 2019 / 2022 Cumulative Update (March 2023)
The March 2023 Patch Tuesday addresses 80 CVEs including CVE-2023-23397, an Outlook privilege escalation that was actively exploited against European organisations before Microsoft patched it. Apply immediately.
An attacker sends a malicious calendar invite to a target. When Outlook processes the reminder, it automatically authenticates to an attacker-controlled server using the victim's NTLM hash. The attacker captures the hash and relays it to authenticate as the victim on other internal systems — no user interaction required beyond receiving the email.
CVE-2023-23397 allows a remote attacker to steal NTLM credentials by sending a specially crafted email. The victim does not need to open the email — receiving it in Outlook triggers the vulnerability automatically when the reminder fires. The March 2023 cumulative update patches this along with 79 other vulnerabilities.
📧
Phishing link
🖼
Malicious file
🔓
Server compromised
Probably yes if any of these apply:
Affected OS versions
Russian APT group APT28 (Fancy Bear) exploited CVE-2023-23397 against military, government, and critical infrastructure organisations in Europe for almost a year before Microsoft patched it in March 2023. Ukrainian organisations were among the primary targets. CISA added this to the KEV catalog on the day of patch release.
Manual download
For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.
↗ Microsoft Update CatalogKB5023706Manual remediation steps
⏱ 30–60 minutes including rebootCheck Patch Status
# Windows Server 2022
Get-HotFix -Id KB5023706
# Windows Server 2019
Get-HotFix -Id KB5023702
Check for CVE-2023-23397 Exposure
# Microsoft released a detection script — run it in Exchange Management Shell
# https://microsoft.com/en-us/download/details.aspx?id=105130
Get-AcceptedDomain | ForEach-Object {
Get-CalendarDiagnosticLog -Identity * -MeetingID * 2>$null
}
Apply
Verify
Get-HotFix -Id KB5023706 # or KB5023702
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
| Patch ID | CVE ID | Vulnerability Name / Type | CVSS | Reference |
|---|---|---|---|---|
| KB5023706 | CVE-2023-23397 | Microsoft Outlook — Windows Server 2019 / 2022 | 9.8 | NVD ↗ |