CVE-2017-11774: Microsoft Office Outlook Security Feature Bypass Allows Remote Code Execution
What It Is – Outlook mishandles objects in memory, enabling a security‑feature bypass that can lead to arbitrary command execution.
Exploitability – Publicly disclosed; proof‑of‑concept code exists. CVSS v3.1 base score 7.8 (High).
Affected Products – Microsoft Office Outlook 2010, 2013, 2016, 2019, and Microsoft 365 desktop clients.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a continuous vulnerability‑management program that tracks patch status across all endpoint applications.
- Provides evidence that an organization can prove timely remediation to auditors and enterprise partners.
- Highlights the importance of secure configuration baselines and monitoring for exploitation attempts as part of a defensible audit trail.
Recommended Actions
- Verify Outlook version on all endpoints and apply the Microsoft security update released Mar 13 2017 (KB 4012598) or later.
- Update your asset inventory to flag Outlook as a high‑risk application requiring rapid patching.
- Enable centralized logging of Outlook process activity and monitor for anomalous command‑execution patterns.
- Document remediation steps in your vulnerability‑management system to furnish audit evidence.
Source: CISA KEV – CVE‑2017‑11774