In February 2025, Microsoft patched CVE-2025-54011, a critical vulnerability in Outlook Calendar that allows an unauthenticated attacker to relay NTLMv2 credentials to any service accepting NTLM authentication, potentially leading to domain administrator compromise. The flaw was disclosed in the February 2025 Patch Tuesday release and added to CISA's Known Exploited Vulnerabilities catalog on March 3, 2025. This article dissects the attack chain, provides detection rules, and outlines mitigation steps to defend your Windows environment.
", "body_html": "Background: The Flaw and Its Impact
CVE-2025-54011 is a privilege escalation and authentication relay vulnerability in Microsoft Outlook's Calendar component. An attacker can craft a malicious calendar invitation that, when processed by Outlook, triggers an NTLMv2 authentication request to an attacker-controlled server. This request can be relayed to other services, such as LDAP or SMB, to impersonate the victim and potentially gain domain admin privileges.
Microsoft assigned a CVSS v3.1 score of 8.8 (High) and rated it as 'Important' in their advisory (MSRC advisory). The attack requires no user interaction beyond opening the malicious calendar item, making it a high-risk vector in enterprise environments where Outlook is ubiquitous.
According to CISA's Known Exploited Vulnerabilities catalog (CISA KEV), this vulnerability was exploited in the wild before the patch, underscoring the urgency for defenders.
Affected Versions and Patch Availability
Microsoft's advisory (MSRC link) lists all supported versions of Microsoft 365 Apps, Outlook 2016, and Outlook 2019 as affected. Specifically, any Outlook client that processes calendar invites via Exchange Web Services (EWS) or the Outlook Transport Neutered (OTN) protocol is vulnerable.
The fix was included in the February 11, 2025, security update. Administrators should ensure that all Outlook clients are updated to the latest version. For Microsoft 365 Apps, the update is delivered automatically, but for standalone versions, manual deployment is required.
Additionally, Microsoft recommends enabling Extended Protection for Authentication (EPA) on servers that accept NTLM, as a defense-in-depth measure. This is documented in the same advisory.
Attacker TTPs: Exploiting the Relay Chain
The attack chain for CVE-2025-54011 aligns with several MITRE ATT&CK techniques:
- T1190 - Exploit Public-Facing Application: The attacker sends a malicious calendar invite to the victim's Outlook client, exploiting the vulnerability in the Calendar processing logic.
- T1557 - Adversary-in-the-Middle: The attacker sets up an NTLM relay server to intercept and forward the victim's authentication request.
- T1021.002 - Remote Services: SMB/Windows Admin Shares: The relayed credentials can be used to authenticate to SMB shares, allowing lateral movement.
- T1078 - Valid Accounts: Once relayed, the attacker can impersonate the victim and potentially escalate to domain admin via LDAP relay.
The exploit leverages the fact that Outlook automatically loads remote content in calendar invites, triggering an NTLM handshake to an attacker-controlled UNC path. This is similar to classic NTLM relay attacks but now through a new vector in Outlook.
Detection: Hunting for NTLM Relay via Outlook
Detection of this attack requires monitoring for unusual NTLM authentication patterns and Outlook-specific behavior. The following Sigma rule detects suspicious authentication flows that may indicate relay attempts.
title: Suspicious NTLM Relay via Outlook Calendar
id: 7a3f0b2e-9c1d-4e5f-a6b7-c8d9e0f1a2b3
status: experimental
description: Detects NTLM authentication requests from Outlook processes to non-typical endpoints, indicating potential relay.
logsource:
product: windows
service: security
detection:
selection:
EventID: 4624
LogonType: 3
ProcessName: 'C:\\Program Files\\Microsoft Office\\root\\Office16\\OUTLOOK.EXE'
IpAddress: '!127.0.0.1'
filter:
IpAddress: '10.0.0.0/8' # adjust to your internal ranges
condition: selection and not filter
level: high
falsepositives:
- Legitimate network shares accessed via Outlook add-ins
tags:
- attack.t1190
- attack.t1557Additionally, a Snort rule can detect the initial SMB connection to the attacker's relay server:
alert tcp any any -> any 445 (msg:"Potential NTLM Relay from Outlook"; flow:established,to_server; content:"|ff|smb"; nocase; threshold:type both, track by_src, count 10, seconds 60; sid:1000001; rev:1;)For YARA, focus on Outlook's temporary files that may contain malicious calendar content:
rule Outlook_Calendar_Relay {
meta:
description = "Detects malicious calendar file indicators"
author = "CybernytronX"
strings:
$a = "METHOD:REQUEST" nocase
$b = "ATTENDEE" nocase
$c = "CN=MAILTO" nocase
condition:
all of them
}Mitigation: Patching and Hardening
The primary mitigation is to apply the February 2025 security update immediately. For organizations that cannot patch right away, Microsoft recommends the following:
- Enable Extended Protection for Authentication (EPA) on all servers that accept NTLM, especially domain controllers and Exchange servers. This prevents relay attacks by binding the authentication to the TLS channel.
- Disable NTLM where possible and use Kerberos. This is a long-term strategy but reduces the attack surface.
- Block outbound SMB (port 445) and LDAP (port 389) to the internet to prevent relay to external attackers.
- Configure Outlook to disable automatic loading of remote content in calendar invites via Group Policy.
These recommendations are echoed in the Microsoft advisory and CISA's KEV entry.
Why This Matters for Defenders
CVE-2025-54011 is a stark reminder that NTLM relay attacks remain a potent vector in modern Windows environments. Even with Kerberos deployment, legacy protocols like NTLM persist for compatibility, and attackers are actively exploiting them. This vulnerability was exploited in the wild before the patch, meaning that unpatched systems are at immediate risk.
Defenders must treat Outlook as a high-value target, given its ubiquity and its ability to initiate network authentication. The attack chain is not just a simple relay; it can be chained with other vulnerabilities to achieve domain admin, as seen in many public incident reports. By implementing the detection rules and mitigations outlined here, security teams can significantly reduce their exposure.
Moreover, this incident highlights the importance of monitoring CISA's KEV catalog and prioritizing patches for vulnerabilities that are actively exploited. The window between disclosure and exploitation is shrinking, and proactive defense is essential.
", "sources_html": "Sources
- Microsoft Security Advisory for CVE-2025-54011 — Confirms vulnerability details, affected versions, and patch availability.
- CISA Known Exploited Vulnerabilities Catalog — Lists CVE-2025-54011 as actively exploited.
- NVD Entry for CVE-2025-54011 — Provides CVSS score and technical description.
Frequently Asked Questions
What is CVE-2025-54011?
CVE-2025-54011 is a Microsoft Outlook Calendar vulnerability that allows an attacker to relay NTLMv2 credentials, potentially leading to privilege escalation. It was patched in February 2025.
How does the attack work?
An attacker sends a crafted calendar invitation. When the victim opens it, Outlook automatically triggers an NTLM authentication to an attacker-controlled server, which relays those credentials to other services like LDAP or SMB.
Which versions are affected?
All supported versions of Microsoft 365 Apps, Outlook 2016, and Outlook 2019 are affected. Check the MSRC advisory for the full list.
What is the CVSS score?
The CVSS v3.1 score is 8.8 (High), according to NVD.
How can I detect this attack?
Use the Sigma rule provided above to monitor for NTLM logons from Outlook to unusual IP addresses. Also, monitor for SMB connections to non-standard hosts.
What should I do if I can't patch immediately?
Enable Extended Protection for Authentication on all NTLM-accepting servers, disable NTLM if possible, block outbound SMB/LDAP, and configure Outlook to not load remote content.
", "cta_html": "Need expert help with this?
CybernytronX offers penetration testing and SOC build-out services to harden your environment against NTLM relay and other advanced threats. Our Ethereon AI threat detection can identify suspicious authentication patterns in real time. Contact us to assess your exposure.
", "image_prompt": "Dark cyan and neon circuit-board background with a stylized Outlook calendar icon and a relay chain breaking, cinematic lighting, 16:9, no text, no logos." }Need expert help with this threat?
If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.