Microsoft Confirms Active Exploitation of New Outlook Zero-day

Microsoft’s Security Response Center has confirmed that attackers were already exploiting a new Outlook security vulnerability before Microsoft released a patch.

The so-called zero-day exploit affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 and prompted the release of a security update, included in the November Patch Tuesday rollout, that covers all supported versions of classic Outlook. The Microsoft Outlook spoofing vulnerability requires only one click on a malicious email file, resulting in a credentials leak and allowing an unauthenticated attacker to access the account.

Jon Levenson, a director at Automox, warned that organizations should "push the fix to your endpoints today."

Please select this link to read the complete article from Forbes.