CVE-2017-11774

CVE-2017-11774 is a security feature bypass in Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and 2013 RT SP1, and Outlook 2016, caused by the way Outlook handles objects in memory, allowing an attacker to execute arbitrary commands. Triggering the flaw requires user interaction on a local system: public research by SensePost (the referenced PoC) showed a specially crafted email can set a mail folder's home page so that attacker-chosen content loads without a security prompt when the user views the folder. A successful attacker gains code execution in the context of the logged-in user, providing a foothold for credential theft or follow-on activity on the workstation. Any organization still running the affected Outlook editions — typically corporate users on Exchange — is exposed, though these are older editions that many organizations have since migrated away from. The flaw is exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03, and the related headlines show US Cyber Command warning that Iran-linked actors were exploiting this CVE alongside other flaws using tools stolen from FireEye, with EPSS putting 30-day exploitation probability at roughly 60% (99th percentile).

What to do: Apply Microsoft's security updates (released with the October 2017 Patch Tuesday or later) for Outlook 2010 SP2, 2013 SP1/2013 RT SP1, and 2016, as required by CISA's KEV listing. Because Outlook 2010 and 2013 are past mainstream support, organizations still running them should upgrade to a supported Outlook release. Defenders should also hunt for exploitation using the indicators US Cyber Command shared with its warning about Iran-linked activity, and check whether user mail folders have had home pages set by untrusted mail.