The vulnerability was found in different Office products, including Microsoft Office LTSC 2021, Microsoft 365 Apps for Enterprise, Microsoft Outlook 2016, and Microsoft Office 2019.
Aside from the Outlook vulnerability, the agency added another four bugs, including a 7-Zip Mark of the Web bypass flaw, a Dante discovery process control flaw, a CyberoamsOS SQL injection flaw, and a Sophos XG Firewall buffer overflow bug.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added a 2024 Outlook flaw to its catalog of known vulnerabilities, warning users about in-the-wild abuse, and giving federal agencies three weeks (until February 27) to patch up or stop using the tool entirely.
US government warns users to patch this critical Microsoft Outlook bug A critical Outlook flaw is being actively exploited.
By exploiting this vulnerability, attackers can bypass Outlook's Protected View (a feature designed to open potentially harmful files in read-only mode) and instead open malicious files in editing mode.
