CVSS 6.5 (MEDIUM) · Actively exploited (listed in CISA KEV)
Microsoft Office Outlook contains a vulnerability where the product UI fails to warn users of unsafe actions. This allows unauthorized attackers to perform spoofing over a network, potentially leading to high confidentiality impact.
Attackers can exploit this flaw to spoof identities and deceive users, resulting in significant data exposure without requiring authentication.
Apply mitigations in accordance with vendor instructions and CISA BOD 26-04 guidance. Evaluate internet exposure and discontinue use if mitigations are unavailable.
Microsoft Office Outlook 存在漏洞，其產品介面未警告用戶不安全操作。這允許未經授權的攻擊者在網絡上進行欺騙，可能導致嚴重的機密性影響。
請按照廠商指示和 CISA BOD 26-04 指南應用緩解措施。評估互聯網暴露風險，若無法緩解則停止使用該產品。