Microsoft Outlook NTLM Credential Leak and EoP
Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An unauthenticated attacker, remotely over the network, with no user interaction, can fully compromise the system — steal data, tamper with it and take it offline.
Microsoft Outlook Elevation of Privilege Vulnerability
Techniques marked “observed” are corroborated by threat intelligence; the rest are inferred from the weakness type (CWE) and attack vector.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Groups documented using the techniques observed against this CVE — a tradecraft association, not a confirmed attribution. Overlap count shown; click for the MITRE profile.
These techniques were analysed against this CVE's real-world exploitation — the matching entries in the ATT&CK chain above are marked “observed”.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
To reduce immediate risk, organizations should block outbound SMB (TCP port 445) traffic from endpoints to the internet and ensure robust endpoint detection and response (EDR) solutions are monitoring for unusual NTLM authentication attempts. Implementing NTLM relay protections like Extended Protection for Authentication (EPA) on critical services can also limit the utility of captured hashes. Additionally, an administrative script or Group Policy can be deployed to disable the `PidLidReminderFileParameter` in Outlook to prevent the vulnerability's trigger.
The permanent resolution involves applying the security updates released by Microsoft for all affected versions of Outlook. These patches address the underlying vulnerability by correctly handling the MAPI properties, preventing the unintended SMB authentication. Administrators should prioritize deploying these updates across all Outlook installations in their environment promptly to fully remediate the threat.
An attacker can exploit this vulnerability by sending a specially crafted email that, upon receipt (even without opening), forces the victim's Outlook client to authenticate to an attacker-controlled SMB share. This allows the attacker to capture the victim's NTLM hash, which can then be relayed to other services or cracked offline to gain unauthorized access and potentially achieve elevation of privilege within the victim's domain. The business consequences include data breaches, system compromise, and significant reputational damage.
Other CVEs affecting 365 apps
Microsoft Outlook Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.
A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".
Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."