Is CVE-2023-35311 (Microsoft Outlook Security Feature Bypass) being exploited in the wild?

Yes. CISA added CVE-2023-35311 to its Known Exploited Vulnerabilities catalogue on 11 July 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt.

What “exploited in the wild” means for this CVE

For a CVE like this, “exploited in the wild” means there is credible evidence that real attackers used the flaw outside a lab or proof-of-concept setting. CISA’s KEV catalogue is the practical signal to watch because it is reserved for vulnerabilities with confirmed active exploitation, not just theoretical abuse. For a broader response workflow, see the Zero-Day and Exploited Vulnerabilities Guide.

That distinction matters operationally: a published CVE may be serious, but a KEV listing means the issue has crossed from possibility to observed abuse. Teams should treat that as a prioritization trigger, not a reporting label.

In practice, the question is not only whether the product is affected, but whether the organisation can still assume the security notice prompt prevented abuse. For this vulnerability, the direct answer already tells you that assumption is unsafe.

How to confirm exposure without overcomplicating the triage

Start by confirming whether Microsoft Outlook is present in the environment and whether systems are in any exposure window relevant to the vendor advisory. Do not rely on generic patch hygiene alone. The right verification step is to tie asset inventory to the specific Outlook deployment and then check the vendor’s guidance against those installations.

If you are already using a vulnerability management workflow, prioritise this finding as a known exploited vulnerability rather than a routine backlog item. The purpose is to establish whether any endpoint, mailbox workflow, or user population could still be exposed to the bypass condition and whether the organisation has compensating controls that actually reduce the impact.

Use official records for version and remediation specifics rather than reproducing them from memory. The authoritative references are the CISA Known Exploited Vulnerabilities Catalog and the CVE Program, with the vendor advisory for precise fix guidance.

What to do if patching or mitigation must wait

If you cannot remediate immediately, the goal is to reduce the chance that the bypass can be reached and to narrow the blast radius if it is reached. That usually means tightening email handling controls, reducing exposure to risky content paths, and increasing scrutiny of suspicious messages or attachments that could trigger user interaction around the Outlook trust prompt. Where email security controls are part of the answer, the Email Security Guide is the right internal reference point.

Temporary mitigations should be treated as a bridge, not a substitute for the fix. If a workaround depends on users behaving safely every time, it is weak by design. Stronger mitigations are those that reduce exposure at the gateway, client, or policy layer rather than asking people to spot a malicious prompt in the middle of normal work.

Where the issue is already in CISA KEV, delay changes the risk profile quickly. The question becomes how long you can tolerate an actively exploited bypass sitting in a user-facing mail client before the likelihood of opportunistic abuse outweighs the inconvenience of emergency change control.

Risk and Threat Considerations

This kind of security feature bypass is risky because it undermines a trust boundary users are trained to rely on. If an attacker can suppress or bypass the warning that should interrupt unsafe content handling, then phishing and malware delivery become easier to stage through normal mail workflows.

Failure mechanism: The flaw weakens a built-in user prompt that is intended to signal risk, so malicious content can move farther into the workflow with less friction and less user hesitation.

Impact: The immediate consequence is higher likelihood of message-driven compromise, followed by possible credential theft, malware execution, or broader account abuse if the message leads to secondary exploitation.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Known exploited CVEs require prioritized identification and remediation.
Recommendation — Prioritise and remediate KEV-listed vulnerabilities on an accelerated schedule.
NIST CSF 2.0	ID.RA-01 — Asset vulnerabilities are identified and recorded	This question depends on confirming whether Outlook is exposed to the exploited flaw.
	PR.PS-01 — Configurations are managed and maintained to meet cybersecurity needs	Mitigation and patching require secure configuration and timely change control.
	DE.CM-09 — Potentially malicious events are analyzed to inform response	Active exploitation should trigger detection and compromise review around mail activity.
Recommendation — Identify affected assets and record the vulnerability in your risk register. Apply the vendor fix or compensating configuration change as soon as feasible. Monitor for suspicious email-related activity and investigate signs of exploitation.
OWASP ASVS	V6 — Authentication	The bypass weakens a trust prompt that affects user-facing security decisions in Outlook.
Recommendation — Review authentication-dependent prompts and remove reliance on user judgment where possible.

Practitioner Guidance

What to prioritise: Treat the KEV listing as a triage override. If Outlook is present anywhere material, validate exposure first, then move the finding into your highest-priority remediation queue rather than waiting for the next normal patch cycle.

What to verify: Confirm whether users, shared mailboxes, or high-value mail-handling roles are the ones most likely to encounter the bypass condition, because those populations create the most useful attacker path.

Decision rule: If you can patch quickly, do that and then review mailbox and endpoint telemetry for signs of malicious email handling around the same window. If you cannot patch quickly, document the exception, apply the strongest available compensating controls, and shorten the exception window aggressively.

Practitioner takeaway: Once a Microsoft Outlook flaw lands in KEV, the practical question is not whether exploitation is possible, but whether your exposure control still depends on a prompt users are expected to trust.