To address this CVE, you must install the Outlook security update, regardless of where your mail is hosted (e.g., Exchange Online, Exchange Server, some other platform). There is a critical security update for Microsoft Outlook for Windows that is required to address CVE-2023-23397. Awareness: Outlook client update for CVE-2023-23397 released More details about specific CVEs can be found in the Security Update Guide (filter on Exchange Server under Product Family). Exchange Online customers are already protected from the vulnerabilities addressed in these SUs and do not need to take any action other than updating Exchange servers in their environment, and if applicable, installing the security update for Outlook on Windows described below. These vulnerabilities affect Exchange Server. Although we are not aware of any active exploits in the wild, our recommendation is to install these updates immediately to protect your environment. The March 2023 SUs address vulnerabilities responsibly reported to Microsoft by security partners and found through Microsoft’s internal processes. Exchange Server 2013 CU23 (note that support and availability of SUs end on April 11, 2023).SUs are available for the following specific versions of Exchange Server: exe package, as well as the original update packages (.msp files), which can be downloaded from the Microsoft Update Catalog.

SUs are available in a self-extracting auto-elevating. Microsoft has released Security Updates (SUs) for vulnerabilities found in:

Exchange server 2016