CVE-2023-35311 is a security feature bypass vulnerability in Microsoft Outlook. CISA added it to the Known Exploited Vulnerabilities catalogue on 11 July 2023, which means attackers have used it in real attacks. Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt.
What the Outlook security feature bypass means
A security feature bypass matters because the product still appears to be enforcing a protective prompt, while the attacker has already found a way around that trust signal. In Outlook, that means the Security Notice prompt can no longer be treated as a reliable indicator that the message or action is safe.
This kind of flaw is dangerous in email clients because users often treat built-in warnings as a last line of defense. When that warning can be bypassed, the attacker does not need to defeat the whole platform, only the specific control the user expects to stop risky content or actions.
For vulnerability tracking and patch intelligence, readers should use the official CVE Program entry and the NIST National Vulnerability Database record rather than relying on secondary summaries for version and remediation details.
How organisations assess exposure to this CVE
Exposure assessment starts with knowing exactly where Microsoft Outlook is installed, which endpoints and virtual desktops are in scope, and whether those systems are internet reachable or commonly used to open untrusted email. That inventory matters because a vulnerability in an email client is only useful to an attacker if the affected software is actually present on reachable user systems.
Organisations should also check vendor advisories and vulnerability intelligence to confirm whether their deployment pattern is affected and whether compensating controls are already reducing exposure. For a broader remediation workflow, NHIMG’s Vulnerability Management Guide is a practical reference for asset scope, prioritisation and verification.
Because this CVE was added to CISA’s Known Exploited Vulnerabilities catalogue on 11 July 2023, it should be treated as an actively exploited issue, not a theoretical one. That elevates the need to find every affected Outlook instance quickly and verify whether controls around email handling, user interaction and update cadence are consistent across the fleet.
Remediation and compensating controls
The primary remediation is to apply the vendor fix as soon as change control allows, but the operational reality is that some environments need interim risk reduction first. In those cases, organisations should tighten mail filtering, reduce exposure to unsolicited content, and reinforce the controls that sit around the user, because a feature bypass often succeeds by exploiting trust in the interface rather than a deep platform failure.
Where patching is delayed, the goal is to make exploitation harder and less valuable. That usually means limiting who can open risky content, reducing the blast radius of a successful click, and keeping endpoint protection, logging and update enforcement aligned so the bypass cannot be used as a quiet entry point.
Microsoft 365 environments benefit from layered controls around Outlook and adjacent services, and NHIMG’s Microsoft 365 Security Guide is useful for understanding how those controls fit together in practice.
Detection and compromise review after patching
Even after remediation, organisations should review whether the weakness was used before it was fixed. For an email-client bypass, that review should focus on suspicious message handling, unexpected follow-on actions from the mailbox or client, and any signs that the attacker used the bypass to reach credentials, sessions, or downstream services.
A patched system can still be compromised if the attacker used the bypass as an initial delivery or interaction method and then moved into other accounts or resources. That is why post-patch validation should include log review, mailbox and endpoint investigation, and confirmation that no persistence or secondary abuse was established through the same user path.
For organisations dealing with Microsoft ecosystems at scale, NHIMG’s CitrixBleed exploitation 2023 and Ivanti Connect Secure exploitation 2024 show how bypasses and appliance flaws often lead to session theft or credential exposure, which is the same post-compromise mindset that should guide review here.
Risk and Threat Considerations
Security feature bypasses are attractive because they can undermine the user’s trust in a built-in warning without requiring the attacker to defeat the entire platform. In practice, that can turn a trusted email client prompt into a weak control that provides false reassurance while malicious content or action proceeds.
Failure mechanism: The attacker exploits a flaw in how Outlook renders or enforces the Security Notice prompt, allowing the malicious flow to continue without the expected warning interrupting the user.
Impact: Users may be tricked into opening or acting on content they would otherwise avoid, which can support phishing, delivery of follow-on payloads, or broader compromise of email-linked accounts and data.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE requires rapid identification and remediation of exposed systems. |
| Recommendation — Prioritise and remediate the Outlook vulnerability across all in-scope assets. | ||
| NIST CSF 2.0 | PR.IP-12 — Vulnerability Management | The term concerns managing a known exploited software weakness through remediation and verification. |
| Recommendation — Track, prioritise and validate remediation for affected Outlook installations. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | Exposure must be found and monitored across the endpoint estate for this exploited flaw. |
| SI-2 — Flaw Remediation | The issue is a remediable software flaw with active exploitation history. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-patch compromise review depends on log analysis and suspicious activity review. | |
| Recommendation — Scan and inventory endpoints to confirm where vulnerable Outlook remains deployed. Apply vendor remediation and verify the fix across all affected systems. Review logs and user activity for signs of pre-patch abuse or persistence. | ||
Practitioner Guidance
Why practitioners should care: Treat this as an email-client trust-control issue, not just a software defect. When a security warning can be bypassed, user education alone is not enough, because the control the user is supposed to notice has already failed.
What to watch for: Prioritise systems that handle external email at scale, endpoints that lag on updates, and any sign that a user interaction led to suspicious authentication, mailbox abuse, or unexpected activity in adjacent Microsoft 365 services.
Practitioner takeaway: Combine fast patching with post-exploitation review, because feature-bypass CVEs often matter most for the time between first abuse and confirmed remediation.
Related resources from NHI Mgmt Group
- CVE-2023-32049 (Microsoft Windows Defender SmartScreen Security Feature Bypass)
- CVE-2023-36584 (Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass)
- CVE-2023-36025 (Microsoft Windows SmartScreen Security Feature Bypass)
- CVE-2022-44698 (Microsoft Defender SmartScreen Security Feature Bypass)