Microsoft
This is rated medium severity (6.5 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Microsoft 365 Apps, Microsoft Office 2021 and Microsoft Office 2024 are in your estate.
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
Exploitable over the network without any account, but only if a user takes an action, such as opening a file or link. High impact on confidentiality.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Exploitability
Longer bar: easier to attack
Impact
Longer bar: more harm
2 links from the CVE record, grouped by site; the vendor's advisory comes first.
msrc.microsoft.com1 linkVendor advisory
cisa.gov1 link
Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorised attacker to perform spoofing over a network.
Next step: Confirm whether Microsoft 365 Apps is in your estate.
Who's reporting
1 of 3 perspectives
Official authority: Official 1Vendor statement missing. no VendorResearcher coverage missing. no Researcher1 signal
Only official coverage so far. Treat as an early signal.
