cyfenced.com →

[ CVE-2017-11774 · Published 13 Oct 2017 ]

Microsoft Office Outlook Security Feature Bypass Vulnerability

Exploited · CISA KEV CVSS 7.8 EPSS 60%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03
  • EPSS: 60% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."

CISA: Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 3 May 2022): Apply updates per vendor instructions.

[ References ]References