CVE-2017-11774: Microsoft Office Outlook Security Feature Bypass Vulnerability

High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 59.6% chance of exploitation in the next 30 days.

Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."

Affected products

• Microsoft Outlook: version 2010 only; version 2013 only; version 2016 only

Published 2017-10-13. Last modified 2026-06-17.