https://vulnerability.circl.lu/sightings/feed 2026-09-03T23:53:29.903476+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/578d522d-99de-4b89-bc0f-fe86255d2c50/export 2026-09-03T23:53:29.927091+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "578d522d-99de-4b89-bc0f-fe86255d2c50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-23397", "type": "seen", "source": "https://t.me/cissp/6663", "content": "exploit\n1. CVE-2020-2546, CVE-2020-2915,\nCVE-2020-2801, CVE-2020-2798,\nCVE-2020-2883, CVE-2020-2884,\nCVE-2020-2950:\nWebLogic T3 payload exploit PoC python3\nhttps://github.com/hktalent/CVE_2020_2546\n\n2. Tips, Tricks, and Scripts for Linux Post Exploitation\nhttps://github.com/regorsec/Linux-Post-Exploitation\n\n3. CVE-2023-23488:\nUnauthenticated SQL Injection - Paid Memberships Pro < 2.9.8 (WordPress Plugin)\nhttps://github.com/r3nt0n/CVE-2023-23488-PoC\n\n4\ud83e\udd78. CVE-2023-23397:\nMicrosoft Outlook EoP Vulnerability\nhttps://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability\n]-> 0-day: https://github.com/sqrtZeroKnowledge/CVE-2023-23397_EXPLOIT_0DAY\n\n5. Producing a PoC for CVE-2022-42475 (Fortinet RCE)\nhttps://blog.scrt.ch/2023/03/14/producing-a-poc-for-cve-2022-42475-fortinet-rce\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.12.25", "creation_timestamp": "2026-09-02T01:04:02.267647Z"} 2026-09-02T01:04:02.267647+00:00 https://vulnerability.circl.lu/sighting/e9e55925-07be-4496-a553-2160b2706286/export 2026-09-03T23:53:29.931364+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "e9e55925-07be-4496-a553-2160b2706286", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-23397", "type": "seen", "source": "https://t.me/cissp/7372", "content": "exploit\nAnalytics\nTop 10 Vulnerabilities of 2023:\n\n1. CVE-2023-34362: MOVEit Vulnerability\n\n2. CVE-2023-23397: MS Outlook PE\n\n3. CVE-2023-43641: 1-Click RCE on GNOME\n\n4. CVE-2023-28252: Windows CLFS PE\n\n5. CVE-2023-2868: Barracuda ESG CI\n\n6. CVE-2023-26360: Adobe ColdFusion\n\n7. CVE-2023-4966: Citrix Bleed\n\n8. CVE-2023-22952: SugarCRM RCE\n\n9. CVE-2023-24880: Win Smart Screen Bypass\nhttps://www.vicarius.io/vsociety/posts/windows-smartscreen-security-feature-bypass-cve-2023-24880\n\n10. CVE-2022-42475:\nFortiOS heap-based buffer overflow in sslvpnd\nhttps://bishopfox.com/blog/exploit-cve-2022-42475\nhttps://github.com/scrt/cve-2022-42475\n\n\n-Cyber Security awareness-\n\u00a0\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n2024.01.06", "creation_timestamp": "2026-09-02T01:03:52.058729Z"} 2026-09-02T01:03:52.058729+00:00 https://vulnerability.circl.lu/sighting/d925b21e-3682-4cf5-b08a-a3dfb1ca071b/export 2026-09-03T23:53:29.931804+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "d925b21e-3682-4cf5-b08a-a3dfb1ca071b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-23397", "type": "seen", "source": "https://t.me/hacking_Attack/94669", "content": "Exploiting CVE-2023-23397: Microsoft Outlook Elevation of Privilege Vulnerability\nhttps://www.reddit.com/r/redteamsec/comments/11rfc4e/exploiting_cve202323397_microsoft_outlook/\n\n submitted by /u/dmchell (https://www.reddit.com/user/dmchell) \n [link] (https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/) [comments] (https://www.reddit.com/r/redteamsec/comments/11rfc4e/exploiting_cve202323397_microsoft_outlook/)", "creation_timestamp": "2026-09-02T01:01:22.656584Z"} 2026-09-02T01:01:22.656584+00:00 https://vulnerability.circl.lu/sighting/a10d6232-8eec-49e2-86eb-adab3b7a7789/export 2026-09-03T23:53:29.932083+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a10d6232-8eec-49e2-86eb-adab3b7a7789", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-23397", "type": "seen", "source": "https://t.me/hacking_Attack/94619", "content": "Black Hat Ethical Hacking\nRussian hackers exploit Outlook zero-day vulnerability to target European organizations\n\nRussian hackers exploit Outlook zero-day vulnerability to target European organizationsPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Microsoft patches Outlook zero-day vulnerability used in attacks by Russian hackersMicrosoft has released a security patch to address a critical vulnerability (CVE-2023-23397) in Outlook that was exploited by a Russian hacking group to target government, military, energy, and transportation organizations in Europe. The group, which has been tracked as APT28, Sednit, and Fancy Bear, used malicious Outlook notes and tasks to steal NTLM hashes, which were then used to access victims\u2019 networks and exfiltrate specific accounts.\n\nThe vulnerability can be exploited through low-complexity attacks by sending messages containing UNC paths to attacker-controlled SMB shares. Microsoft recommends immediate patching or temporary mitigation by adding users to the Protected Users group in Active Directory and blocking outbound SMB.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Outlook versions affectedAccording to Microsoft, the vulnerability affects all supported versions of Outlook for Windows but not Outlook for Android, iOS, or macOS versions. Online services like Outlook on the web and Microsoft 365 do not support NTLM authentication, making them immune to attacks exploiting this NTLM relay vulnerability.\nTo help admins check if any users in their Exchange environment have been targeted using this Outlook vulnerability, Microsoft released a dedicated PowerShell script that checks Exchange messaging items for malicious UNC paths and allows modifying or deleting potentially malicious messages if they are found on the audited Exchange Server when run in Cleanup mode.\n\nThis critical elevation of privilege security flaw was first reported by the Computer Emergency Response Team for Ukraine (CERT-UA). Microsoft shared this information in a private threat analytics report available to customers with Microsoft 365 Defender, Microsoft Defender for Business, or Microsoft Defender for Endpoint Plan 2 subscriptions.\nTrending: Major Cyber Attacks of 2022\nTrending: Offensive Security Tool: CrackQL MitigationIn addition to patching, Microsoft advises adding users to the Protected Users group in Active Directory and blocking outbound SMB to limit the impact of the attacks.\n\nMicrosoft urges its customers to take immediate action and patch their systems against CVE-2023-23397 or add users to the Protected Users group in Active Directory and block outbound SMB as a temporary mitigation to minimize the impact of the attacks.\nTrending: Proof-of-concept for critical Microsoft Word vulnerability published\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-5-1-300x150.png Kali Linux 2023.1 \u2013 Adds Kali Purple for defensive security, python updates, new toolsMarch 14, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-3-1-300[...]", "creation_timestamp": "2026-09-02T01:01:22.610471Z"} 2026-09-02T01:01:22.610471+00:00 https://vulnerability.circl.lu/sighting/659d00b3-7ffe-4170-9217-35864fb318da/export 2026-09-03T23:53:29.932438+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "659d00b3-7ffe-4170-9217-35864fb318da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-23397", "type": "seen", "source": "https://t.me/hacking_Attack/101648", "content": "Black Hat Ethical Hacking\nMicrosoft\u2019s Urgent Fix: Bypassing Recent Patches for Critical Outlook Zero-Day Exploited in the Wild\n\nMicrosoft\u2019s Urgent Fix: Bypassing Recent Patches for Critical Outlook Zero-Day Exploited in the WildPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Microsoft Addresses Critical Outlook Zero-Day Bypass Vulnerability Microsoft swiftly responded to a security vulnerability this week, addressing a flaw that allowed remote attackers to bypass recent patches targeting a critical zero-day security issue in Outlook. This zero-click bypass, known as CVE-2023-29324, impacts all supported versions of Windows and was brought to light by Akamai security researcher Ben Barnea.\n\nBarnea explained, \u201cAll Windows versions are affected by the vulnerability. As a result, all Outlook client versions on Windows are exploitable.\u201d\n\nThe previously patched Outlook zero-day bug, identified as CVE-2023-23397, is a privilege escalation flaw in the Outlook client for Windows. This flaw enables attackers to illicitly obtain NTLM hashes without user interaction in NTLM-relay attacks. Exploiting the bug involves sending messages with extended MAPI properties containing UNC paths to customized notification sounds, leading the Outlook client to connect to SMB shares under the attackers\u2019 control.\n\nMicrosoft tackled the issue by implementing a MapUrlToZone call to ensure that UNC paths do not link to internet URLs. Additionally, they replaced the sounds with default reminders if such links were detected.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Microsoft Warns of Critical Outlook Zero-Day Bypass Vulnerability Exploited by APT28 HackersDuring the analysis of the CVE-2023-23397 mitigation, Barnea discovered a way to change the URL in reminder messages, tricking the MapUrlToZone checks into accepting remote paths as local paths. This bypasses Microsoft\u2019s patch, resulting in the Windows Outlook client connecting to the attacker\u2019s server.\n\nBarnea shed light on the matter, stating, \u201cThis issue seems to be a result of the complex handling of paths in Windows.\u201d\n\nIn response to Barnea\u2019s findings, Microsoft issued a warning, emphasizing the importance of installing updates for both CVE-2023-23397 and CVE-2023-29324 to ensure comprehensive protection.\nRemember that 0-click Outlook vulnerability with a custom sound leading to NTLM theft?\n\nAkamai researchers found a way to bypass the patch to it. \n\nIn our write-up, see how adding a slash allowed for a bypass.https://t.co/eO121SaZur pic.twitter.com/YrrBikMZqj\n\n\u2014 Akamai Security Intelligence Group (@akamai_research) May 10, 2023\nWhile Internet Explorer has been retired, the vulnerable MSHTML platform is still utilized by certain applications through the WebBrowser control, as well as by the Internet Explorer mode in Microsoft Edge. Consequently, Microsoft urges customers to install the latest security updates and the IE Cumulative updates, specifically addressing the CVE-2023-29324 vulnerability, to remain fully protected.\n\nThe severity of this vulnerability became evident as Microsoft unveiled details from a private threat analytics report, revealing that it had been exploited by Russian APT28 state hackers, also known as STRONTIUM, Sednit, Sofacy, or Fancy Bear. These hackers targeted at least 14 government, military, energy, and transportation organizations between mid-April and December 2022.\nTrending: How to Exploit \u201cimproper error handling\u201d in Web Applications Trending: Malware Analysis Tool: retoolkit\nAPT28 is closely associated w[...]", "creation_timestamp": "2026-09-02T01:01:18.825490Z"} 2026-09-02T01:01:18.825490+00:00 https://vulnerability.circl.lu/sighting/b960ba44-b24c-441e-b120-0d40b8ba22b3/export 2026-09-03T23:53:29.932699+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "b960ba44-b24c-441e-b120-0d40b8ba22b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-23397", "type": "seen", "source": "https://t.me/hacking_Attack/102013", "content": "Black Hat Ethical Hacking\nMicrosoft\u2019s Urgent Fix: Bypassing Recent Patches for Critical Outlook Zero-Day Exploited in the Wild\n\nMicrosoft\u2019s Urgent Fix: Bypassing Recent Patches for Critical Outlook Zero-Day Exploited in the WildPost Views: 2,248 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Microsoft Addresses Critical Outlook Zero-Day Bypass Vulnerability Microsoft swiftly responded to a security vulnerability this week, addressing a flaw that allowed remote attackers to bypass recent patches targeting a critical zero-day security issue in Outlook. This zero-click bypass, known as CVE-2023-29324, impacts all supported versions of Windows and was brought to light by Akamai security researcher Ben Barnea.\n\nBarnea explained, \u201cAll Windows versions are affected by the vulnerability. As a result, all Outlook client versions on Windows are exploitable.\u201d\n\nThe previously patched Outlook zero-day bug, identified as CVE-2023-23397, is a privilege escalation flaw in the Outlook client for Windows. This flaw enables attackers to illicitly obtain NTLM hashes without user interaction in NTLM-relay attacks. Exploiting the bug involves sending messages with extended MAPI properties containing UNC paths to customized notification sounds, leading the Outlook client to connect to SMB shares under the attackers\u2019 control.\n\nMicrosoft tackled the issue by implementing a MapUrlToZone call to ensure that UNC paths do not link to internet URLs. Additionally, they replaced the sounds with default reminders if such links were detected.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Microsoft Warns of Critical Outlook Zero-Day Bypass Vulnerability Exploited by APT28 HackersDuring the analysis of the CVE-2023-23397 mitigation, Barnea discovered a way to change the URL in reminder messages, tricking the MapUrlToZone checks into accepting remote paths as local paths. This bypasses Microsoft\u2019s patch, resulting in the Windows Outlook client connecting to the attacker\u2019s server.\n\nBarnea shed light on the matter, stating, \u201cThis issue seems to be a result of the complex handling of paths in Windows.\u201d\n\nIn response to Barnea\u2019s findings, Microsoft issued a warning, emphasizing the importance of installing updates for both CVE-2023-23397 and CVE-2023-29324 to ensure comprehensive protection.\nRemember that 0-click Outlook vulnerability with a custom sound leading to NTLM theft?\n\nAkamai researchers found a way to bypass the patch to it. \n\nIn our write-up, see how adding a slash allowed for a bypass.https://t.co/eO121SaZur pic.twitter.com/YrrBikMZqj\n\n\u2014 Akamai Security Intelligence Group (@akamai_research) May 10, 2023\nWhile Internet Explorer has been retired, the vulnerable MSHTML platform is still utilized by certain applications through the WebBrowser control, as well as by the Internet Explorer mode in Microsoft Edge. Consequently, Microsoft urges customers to install the latest security updates and the IE Cumulative updates, specifically addressing the CVE-2023-29324 vulnerability, to remain fully protected.\n\nThe severity of this vulnerability became evident as Microsoft unveiled details from a private threat analytics report, revealing that it had been exploited by Russian APT28 state hackers, also known as STRONTIUM, Sednit, Sofacy, or Fancy Bear. These hackers targeted at least 14 government, military, energy, and transportation organizations between mid-April and December 2022.\nTrending: How to Exploit \u201cimproper error handling\u201d in Web Applications Trending: Malware Analysis Tool: retoolkit\nAPT28 is closely asso[...]", "creation_timestamp": "2026-09-02T01:01:18.639891Z"} 2026-09-02T01:01:18.639891+00:00 https://vulnerability.circl.lu/sighting/0845ca9a-66da-40e4-8b48-cca43655006c/export 2026-09-03T23:53:29.932856+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "0845ca9a-66da-40e4-8b48-cca43655006c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-23397", "type": "seen", "source": "https://t.me/hacking_Attack/94669", "content": "Exploiting CVE-2023-23397: Microsoft Outlook Elevation of Privilege Vulnerability\nhttps://www.reddit.com/r/redteamsec/comments/11rfc4e/exploiting_cve202323397_microsoft_outlook/\n\n submitted by /u/dmchell (https://www.reddit.com/user/dmchell) \n [link] (https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/) [comments] (https://www.reddit.com/r/redteamsec/comments/11rfc4e/exploiting_cve202323397_microsoft_outlook/)", "creation_timestamp": "2026-09-01T20:01:02.817441Z"} 2026-09-01T20:01:02.817441+00:00 https://vulnerability.circl.lu/sighting/b3fa87be-0760-45d1-ba6a-4a65f7825d78/export 2026-09-03T23:53:29.933001+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "b3fa87be-0760-45d1-ba6a-4a65f7825d78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-23397", "type": "seen", "source": "https://t.me/hacking_Attack/94619", "content": "Black Hat Ethical Hacking\nRussian hackers exploit Outlook zero-day vulnerability to target European organizations\n\nRussian hackers exploit Outlook zero-day vulnerability to target European organizationsPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Microsoft patches Outlook zero-day vulnerability used in attacks by Russian hackersMicrosoft has released a security patch to address a critical vulnerability (CVE-2023-23397) in Outlook that was exploited by a Russian hacking group to target government, military, energy, and transportation organizations in Europe. The group, which has been tracked as APT28, Sednit, and Fancy Bear, used malicious Outlook notes and tasks to steal NTLM hashes, which were then used to access victims\u2019 networks and exfiltrate specific accounts.\n\nThe vulnerability can be exploited through low-complexity attacks by sending messages containing UNC paths to attacker-controlled SMB shares. Microsoft recommends immediate patching or temporary mitigation by adding users to the Protected Users group in Active Directory and blocking outbound SMB.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Outlook versions affectedAccording to Microsoft, the vulnerability affects all supported versions of Outlook for Windows but not Outlook for Android, iOS, or macOS versions. Online services like Outlook on the web and Microsoft 365 do not support NTLM authentication, making them immune to attacks exploiting this NTLM relay vulnerability.\nTo help admins check if any users in their Exchange environment have been targeted using this Outlook vulnerability, Microsoft released a dedicated PowerShell script that checks Exchange messaging items for malicious UNC paths and allows modifying or deleting potentially malicious messages if they are found on the audited Exchange Server when run in Cleanup mode.\n\nThis critical elevation of privilege security flaw was first reported by the Computer Emergency Response Team for Ukraine (CERT-UA). Microsoft shared this information in a private threat analytics report available to customers with Microsoft 365 Defender, Microsoft Defender for Business, or Microsoft Defender for Endpoint Plan 2 subscriptions.\nTrending: Major Cyber Attacks of 2022\nTrending: Offensive Security Tool: CrackQL MitigationIn addition to patching, Microsoft advises adding users to the Protected Users group in Active Directory and blocking outbound SMB to limit the impact of the attacks.\n\nMicrosoft urges its customers to take immediate action and patch their systems against CVE-2023-23397 or add users to the Protected Users group in Active Directory and block outbound SMB as a temporary mitigation to minimize the impact of the attacks.\nTrending: Proof-of-concept for critical Microsoft Word vulnerability published\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-5-1-300x150.png Kali Linux 2023.1 \u2013 Adds Kali Purple for defensive security, python updates, new toolsMarch 14, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-3-1-300[...]", "creation_timestamp": "2026-09-01T20:01:02.770163Z"} 2026-09-01T20:01:02.770163+00:00 https://vulnerability.circl.lu/sighting/277b0de3-3602-4969-a3ed-72887788eaea/export 2026-09-03T23:53:29.933146+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "277b0de3-3602-4969-a3ed-72887788eaea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-23397", "type": "seen", "source": "https://t.me/hacking_Attack/101648", "content": "Black Hat Ethical Hacking\nMicrosoft\u2019s Urgent Fix: Bypassing Recent Patches for Critical Outlook Zero-Day Exploited in the Wild\n\nMicrosoft\u2019s Urgent Fix: Bypassing Recent Patches for Critical Outlook Zero-Day Exploited in the WildPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Microsoft Addresses Critical Outlook Zero-Day Bypass Vulnerability Microsoft swiftly responded to a security vulnerability this week, addressing a flaw that allowed remote attackers to bypass recent patches targeting a critical zero-day security issue in Outlook. This zero-click bypass, known as CVE-2023-29324, impacts all supported versions of Windows and was brought to light by Akamai security researcher Ben Barnea.\n\nBarnea explained, \u201cAll Windows versions are affected by the vulnerability. As a result, all Outlook client versions on Windows are exploitable.\u201d\n\nThe previously patched Outlook zero-day bug, identified as CVE-2023-23397, is a privilege escalation flaw in the Outlook client for Windows. This flaw enables attackers to illicitly obtain NTLM hashes without user interaction in NTLM-relay attacks. Exploiting the bug involves sending messages with extended MAPI properties containing UNC paths to customized notification sounds, leading the Outlook client to connect to SMB shares under the attackers\u2019 control.\n\nMicrosoft tackled the issue by implementing a MapUrlToZone call to ensure that UNC paths do not link to internet URLs. Additionally, they replaced the sounds with default reminders if such links were detected.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Microsoft Warns of Critical Outlook Zero-Day Bypass Vulnerability Exploited by APT28 HackersDuring the analysis of the CVE-2023-23397 mitigation, Barnea discovered a way to change the URL in reminder messages, tricking the MapUrlToZone checks into accepting remote paths as local paths. This bypasses Microsoft\u2019s patch, resulting in the Windows Outlook client connecting to the attacker\u2019s server.\n\nBarnea shed light on the matter, stating, \u201cThis issue seems to be a result of the complex handling of paths in Windows.\u201d\n\nIn response to Barnea\u2019s findings, Microsoft issued a warning, emphasizing the importance of installing updates for both CVE-2023-23397 and CVE-2023-29324 to ensure comprehensive protection.\nRemember that 0-click Outlook vulnerability with a custom sound leading to NTLM theft?\n\nAkamai researchers found a way to bypass the patch to it. \n\nIn our write-up, see how adding a slash allowed for a bypass.https://t.co/eO121SaZur pic.twitter.com/YrrBikMZqj\n\n\u2014 Akamai Security Intelligence Group (@akamai_research) May 10, 2023\nWhile Internet Explorer has been retired, the vulnerable MSHTML platform is still utilized by certain applications through the WebBrowser control, as well as by the Internet Explorer mode in Microsoft Edge. Consequently, Microsoft urges customers to install the latest security updates and the IE Cumulative updates, specifically addressing the CVE-2023-29324 vulnerability, to remain fully protected.\n\nThe severity of this vulnerability became evident as Microsoft unveiled details from a private threat analytics report, revealing that it had been exploited by Russian APT28 state hackers, also known as STRONTIUM, Sednit, Sofacy, or Fancy Bear. These hackers targeted at least 14 government, military, energy, and transportation organizations between mid-April and December 2022.\nTrending: How to Exploit \u201cimproper error handling\u201d in Web Applications Trending: Malware Analysis Tool: retoolkit\nAPT28 is closely associated w[...]", "creation_timestamp": "2026-09-01T20:00:58.666194Z"} 2026-09-01T20:00:58.666194+00:00 https://vulnerability.circl.lu/sighting/8a0bb160-9b64-425d-99c6-096a99bbc09d/export 2026-09-03T23:53:29.933290+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "8a0bb160-9b64-425d-99c6-096a99bbc09d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-23397", "type": "seen", "source": "https://t.me/hacking_Attack/102013", "content": "Black Hat Ethical Hacking\nMicrosoft\u2019s Urgent Fix: Bypassing Recent Patches for Critical Outlook Zero-Day Exploited in the Wild\n\nMicrosoft\u2019s Urgent Fix: Bypassing Recent Patches for Critical Outlook Zero-Day Exploited in the WildPost Views: 2,248 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Microsoft Addresses Critical Outlook Zero-Day Bypass Vulnerability Microsoft swiftly responded to a security vulnerability this week, addressing a flaw that allowed remote attackers to bypass recent patches targeting a critical zero-day security issue in Outlook. This zero-click bypass, known as CVE-2023-29324, impacts all supported versions of Windows and was brought to light by Akamai security researcher Ben Barnea.\n\nBarnea explained, \u201cAll Windows versions are affected by the vulnerability. As a result, all Outlook client versions on Windows are exploitable.\u201d\n\nThe previously patched Outlook zero-day bug, identified as CVE-2023-23397, is a privilege escalation flaw in the Outlook client for Windows. This flaw enables attackers to illicitly obtain NTLM hashes without user interaction in NTLM-relay attacks. Exploiting the bug involves sending messages with extended MAPI properties containing UNC paths to customized notification sounds, leading the Outlook client to connect to SMB shares under the attackers\u2019 control.\n\nMicrosoft tackled the issue by implementing a MapUrlToZone call to ensure that UNC paths do not link to internet URLs. Additionally, they replaced the sounds with default reminders if such links were detected.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Microsoft Warns of Critical Outlook Zero-Day Bypass Vulnerability Exploited by APT28 HackersDuring the analysis of the CVE-2023-23397 mitigation, Barnea discovered a way to change the URL in reminder messages, tricking the MapUrlToZone checks into accepting remote paths as local paths. This bypasses Microsoft\u2019s patch, resulting in the Windows Outlook client connecting to the attacker\u2019s server.\n\nBarnea shed light on the matter, stating, \u201cThis issue seems to be a result of the complex handling of paths in Windows.\u201d\n\nIn response to Barnea\u2019s findings, Microsoft issued a warning, emphasizing the importance of installing updates for both CVE-2023-23397 and CVE-2023-29324 to ensure comprehensive protection.\nRemember that 0-click Outlook vulnerability with a custom sound leading to NTLM theft?\n\nAkamai researchers found a way to bypass the patch to it. \n\nIn our write-up, see how adding a slash allowed for a bypass.https://t.co/eO121SaZur pic.twitter.com/YrrBikMZqj\n\n\u2014 Akamai Security Intelligence Group (@akamai_research) May 10, 2023\nWhile Internet Explorer has been retired, the vulnerable MSHTML platform is still utilized by certain applications through the WebBrowser control, as well as by the Internet Explorer mode in Microsoft Edge. Consequently, Microsoft urges customers to install the latest security updates and the IE Cumulative updates, specifically addressing the CVE-2023-29324 vulnerability, to remain fully protected.\n\nThe severity of this vulnerability became evident as Microsoft unveiled details from a private threat analytics report, revealing that it had been exploited by Russian APT28 state hackers, also known as STRONTIUM, Sednit, Sofacy, or Fancy Bear. These hackers targeted at least 14 government, military, energy, and transportation organizations between mid-April and December 2022.\nTrending: How to Exploit \u201cimproper error handling\u201d in Web Applications Trending: Malware Analysis Tool: retoolkit\nAPT28 is closely asso[...]", "creation_timestamp": "2026-09-01T20:00:58.477641Z"} 2026-09-01T20:00:58.477641+00:00