CVE intelligenceCISA KEV

CVE-2023-23397

Microsoft Office Outlook Privilege Escalation Vulnerability

Published Mar 14, 2023Sources checked Oct 28, 2026

9.8CRITICALCVSS out of 10

What this means

Actively exploited

CISA lists CVE-2023-23397 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to Microsoft Office.

Apply updates per vendor instructions.

CISA KEVListedObserved exploitation

EPSS97.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors2Source-linked actor relationships

Overview

What is CVE-2023-23397?

Microsoft Outlook Elevation of Privilege Vulnerability

Source: NVD

CISA says:Apply updates per vendor instructions.CISA catalog due date Apr 4, 2023