PatchTheCVECVE-2023-35311: Microsoft Outlook Security Feature Bypass Vulnerability
85
Patch now
HIGH 8.8EXPLOITEDWATCHLISTMITIGATEMITIGATEMITIGATE
CVE-2023-35311 is a high-severity flaw (CVSS 8.8) affecting 365 apps, office 2019, office 2021, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Microsoft Outlook Security Feature Bypass Vulnerability
Why this priority
- High severity
- EPSS top 3%: very likely to be exploited
- Exploited in the wild (CISA KEV)
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.8 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 15.5% (top 3%) |
| CISA exploited list | Yes, fix due 2023-08-01 |
| Weakness | CWE-367 |
| Published | 2023-07-11 |
| Last modified | 2026-10-08 |
Publisher (CNA): Microsoft Corporation · Vendor: microsoft
Last updated 2026-10-08 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Exploited Added to the CISA Known Exploited Vulnerabilities list
- Published CVE record published
- Deadline CISA due date for US federal agencies to patch
- Updated Record last modified
microsoft 365 apps MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy 365-apps || rpm -q 365-apps || 365-apps --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
microsoft office 2019 MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy office-2019 || rpm -q office-2019 || office-2019 --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
microsoft office 2021 MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy office-2021 || rpm -q office-2021 || office-2021 --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
microsoft outlook DOWNGRADE
Affected: 2013
Fixed in: no fixed release known
Safe to downgrade to: a release before 2013
1. Check installed version
apt-cache policy outlook || rpm -q outlook || outlook --version
2. No fixed release: DOWNGRADE to a release before 2013 (Debian / Ubuntu)
apt-cache madison outlook
sudo apt install outlook=<VERSION_BEFORE_2013>
sudo apt-mark hold outlook
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list outlook
sudo dnf downgrade outlook-<VERSION_BEFORE_2013>
sudo dnf versionlock add outlook
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft outlook DOWNGRADE
Affected: 2013 sp1 · 2016
Fixed in: no fixed release known
Safe to downgrade to: a release before 2013
1. Check installed version
apt-cache policy outlook || rpm -q outlook || outlook --version
2. No fixed release: DOWNGRADE to a release before 2013 (Debian / Ubuntu)
apt-cache madison outlook
sudo apt install outlook=<VERSION_BEFORE_2013>
sudo apt-mark hold outlook
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list outlook
sudo dnf downgrade outlook-<VERSION_BEFORE_2013>
sudo dnf versionlock add outlook
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Exact fixes by distribution
A distro patch exists: prefer upgrading over downgrading.
Fedora 46 · borgmatic · FIXED · 2.2.0-1.fc46 · FEDORA-2026-041229e71b · source
sudo dnf upgrade --advisory=FEDORA-2026-041229e71b
Fedora ELN · pie · FIXED · 1.5.4-1.eln159 · FEDORA-2026-a2c0261d3a · source
sudo dnf upgrade --advisory=FEDORA-2026-a2c0261d3a
Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-35311?
365 apps: mitigate or apply the listed mitigation; office 2019: mitigate or apply the listed mitigation; office 2021: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2023-35311 being exploited?
Yes. CVE-2023-35311 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.
What does CVE-2023-35311 affect?
CVE-2023-35311 affects 365 apps, office 2019, office 2021. Severity is high (CVSS 8.8). Microsoft Outlook Security Feature Bypass Vulnerability
How urgent is CVE-2023-35311?
Priority 85/100. High severity; EPSS top 3%: very likely to be exploited; Exploited in the wild (CISA KEV); On your watchlist
Software pages
Microsoft Office vulnerabilities · Outlook vulnerabilities
Related CVEs
- CVE-2023-36009 MEDIUM 5.5 MITIGATE DOWNGRADE Microsoft Word Information Disclosure Vulnerability
- CVE-2022-34717 HIGH 8.8 MITIGATE DOWNGRADE Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-81396 HIGH 7.8 MITIGATE DOWNGRADE Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-78524 HIGH 8.8 MITIGATE MITIGATE Out-of-bounds write in Microsoft Office allows an unauthorized attacker to execute code over a network.
- CVE-2026-77911 MEDIUM 6.5 MITIGATE MITIGATE Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a net