EXPOSURES › CVE-2024-21413
CVE-2024-21413
HIGH ⌖ ON CISA KEV · EXPLOITEDMicrosoft Outlook's improper input validation allows attackers to bypass Protected View and execute code remotely, currently being exploited in the wild.
An actively exploited vulnerability in Microsoft Outlook (CVE-2024-21413) enables attackers to bypass Protected View and execute code, potentially compromising systems. DIB organizations using Outlook must immediately patch to prevent exploitation and maintain CMMC/NIST 800-171 compliance. Prioritize patching and review email security protocols.
Shame score — The vulnerability's active exploitation and potential for remote code execution demonstrate a significant security oversight by Microsoft, impacting a widely used product.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |