Microsoft discloses unpatched Office flaw that exposes NTLM hashes

Microsoft disclosed CVE-2024-38200, an information-disclosure vulnerability in Office 2016, Office 2019, Office LTSC 2021, and Microsoft 365 Apps that can be abused to force outbound NTLM authentication and leak NTLM hashes; Microsoft applied an interim fix via Feature Flighting on 2024-07-30 and advises applying the August 13, 2024 updates or mitigating by blocking outbound NTLM traffic.