Microsoft Confirms Hackers Are Exploiting Outlook 0-Day to Steal Windows Authentication Hashes - CyberSecurityNews

The vulnerability carries a CVSS score of 6.5 and a Moderate severity rating. However, Microsoft's Exploitability Index marks it as "Exploitation Detected," meaning the company knows of actual attacks rather than just theoretical exploitation possibilities.

Attackers don't need an account or prior access to a target's system. Instead, they send specially crafted message files and convince recipients to open them in affected Outlook versions. Successful exploitation requires both user interaction and network connectivity.

Attack Mechanism

Opening the malicious file can cause Outlook to connect to an attacker-controlled network location without showing its usual external-content warning. Microsoft classifies the underlying weakness as CWE-356, where a product's interface fails to warn users about unsafe actions.

Microsoft explicitly states that the Preview Pane is not an attack vector. Simply previewing a message does not meet the documented exploitation requirements, separating this flaw from earlier Outlook attacks.

Impact and Protection

Successful exploitation discloses the user's NTLMv2 hash, potentially allowing an attacker to authenticate as that user. Microsoft rates confidentiality impact as High, with no direct integrity or availability impact.

Affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. Microsoft lists fixed builds 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024. Administrators should deploy the applicable Office security updates promptly.

For added protection, Microsoft recommends blocking unnecessary outbound SMB traffic on TCP port 445 to the internet. This limits external SMB exposure but does not replace installing the Outlook fix.