{"id":"CVE-2017-11774","published":"2017-10-13T13:29:00Z","modified":"2026-06-17T01:02:20Z","title":"Microsoft Office Outlook Security Feature Bypass Vulnerability","vendor":"Microsoft","product":"Office","tier":"core","eol":null,"description":{"text":"Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka \"Microsoft Outlook Security Feature Bypass Vulnerability.\"","provenance":"source","from":"NVD"},"summary":{"text":"A memory-handling flaw in Microsoft Office's shared components, affecting Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016, lets an attacker execute arbitrary commands. Exploitation requires local access to the system, no prior privileges, and a user to interact with a crafted object or file.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:03:37Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.59627,"percentile":0.99122,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-11774","provenance":"source"},"vulncheckKev":{"dateAdded":"2018-12-21","exploitedFirstSeen":"2018-12-21","ransomware":false,"evidence":[{"url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html","date":"2018-12-21"},{"url":"https://www.tenable.com/blog/daisy-chaining-how-vulnerabilities-can-be-greater-than-the-sum-of-their-parts","date":"2021-01-21"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://www.tenable.com/blog/frequently-asked-questions-about-iranian-cyber-operations","date":"2025-06-27"},{"url":"https://www.picussecurity.com/resource/iranian-threat-actors-what-defenders-need-to-know","date":"2026-03-06"},{"url":"https://horizon3.ai/wp-content/uploads/2026/03/Iranian_APT_TTP_Report_2026.pdf","date":"2026-03-16"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"http://www.securityfocus.com/bid/101098","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039542","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774","tags":["Patch","Vendor Advisory"]},{"url":"https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/","tags":["Exploit"]},{"url":"http://www.securityfocus.com/bid/101098","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039542","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774","tags":["Patch","Vendor Advisory"]},{"url":"https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/","tags":["Exploit"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11774","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"needs user interaction; not a public-facing exploit"},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: user opens malicious file or message","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allow an attacker to execute arbitrary commands","start":74,"end":121}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary command execution on victim","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allow an attacker to execute arbitrary commands","start":74,"end":121}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-2b2cfd823e79c61e3f3a","title":"Inside Microsoft 365 Defender: Mapping attack chains from cloud to endpoint","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/","date":"2020-06-18","mentions":[{"quote":"The group used Ruler to configure a specially crafted Outlook Home Page URL to exploit the security bypass vulnerability CVE-2017-11774, which was fixed shortly after it was discovered.","start":2956,"end":3141},{"quote":"Office 365 accounts and not blocked by MFA defense, the group launched the next step with Ruler and configured a malicious Home Page URL which, once rendered during a normal email session, resulted in the remote code execution of a PowerShell backdoor through the exploitation of a vulnerability like CVE-2017-11774.","start":5156,"end":5472}]},{"id":"SRC-7f80eadb83bfff15d2c9","title":"OVERRULED: Containing a Potentially Destructive Adversary","publisher":"cloud.google.com","url":"https://cloud.google.com/blog/topics/threat-intelligence/overruled-containing-a-potentially-destructive-adversary","date":null,"mentions":[{"quote":"Cyber Command's July 2019 CVE-2017-11774 indicators, which FireEye also attributes to APT33.","start":583,"end":675},{"quote":"The actor leveraged stolen credentials and RULER’s module that exploits CVE-2017-11774 (RULER.HOMEPAGE), modifying numerous users’ Outlook client homepages for code execution and persistence.","start":5589,"end":5780},{"quote":"Figure 1: Attacker’s homepage exploit (CVE-2017-11774)","start":6503,"end":6557},{"quote":"SensePost's identification and responsible disclosure of CVE-2017-11774 was no different.","start":19949,"end":20038},{"quote":"This is understandable, as some defenders may first learn of successful CVE-2017-11774 exploitation when observing Outlook spawning processes resulting in malicious code execution.","start":20475,"end":20655}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-3382","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-3382","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2019-08-16","earliestUrl":"https://github.com/devcoinfet/SniperRoost","repos":[{"name":"devcoinfet/SniperRoost","url":"https://github.com/devcoinfet/SniperRoost","stars":1,"created":"2019-08-16"}]},"first":{"date":"2019-08-16","source":"PoC-in-GitHub","url":"https://github.com/devcoinfet/SniperRoost"},"provenance":"source"},"exploitRefs":["https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/"],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1190"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2017-10-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11774","provenance":"source"},{"date":"2018-12-21","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html","provenance":"source"},{"date":"2019-08-16","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/devcoinfet/SniperRoost","provenance":"source"},{"date":"2020-06-18","kind":"report","label":"Named in microsoft.com: Inside Microsoft 365 Defender: Mapping attack chains from cloud to endpoint","url":"https://www.microsoft.com/en-us/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/","provenance":"machine"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-3382","provenance":"source"}],"speed":{"daysToPublicExploit":672,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1482},"priority":{"score":74.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2869 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.82,"detail":"percentile 0.9912"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-office-cwe-119"}}