CVE intelligenceCISA KEV

CVE-2023-23397

Microsoft Office Outlook Privilege Escalation Vulnerability

Published Mar 14, 2023Sources checked Sep 12, 2026

9.8CRITICALCVSS out of 10

What this means

Actively exploited

CISA lists CVE-2023-23397 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to Microsoft Office.

Apply updates per vendor instructions.

CISA KEVListedObserved exploitation

EPSS97.4%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors2Source-linked actor relationships

Overview

What is CVE-2023-23397?

Microsoft Outlook Elevation of Privilege Vulnerability