Microsoft Outlook CVE-2024-21413 'MonikerLink' (crafted file:// links with '!' bypass Protected View, leak NTLM credentials and can lead to code execution, CISA KEV): how do I make sure Outlook is patched and limit the risk?

What it is: CVE-2024-21413 is a critical (CVSS 9.8) remote code execution flaw in Microsoft Outlook found by Check Point Research and fixed in the February 2024 Patch Tuesday. Outlook normally blocks links to remote files, but a specially formed file:// link with an exclamation mark and extra text (a 'Moniker link') got past that check. Clicking it could send the user's local NTLM credential information to an attacker's server over SMB, and could open the target through COM in a way that skips Office's Protected View, opening a path to code execution. CISA added it to the Known Exploited Vulnerabilities catalog on 2025-02-06. Am I affected: - Outlook / Microsoft Office installations that haven't received the February 2024 or later security updates. Check Point confirmed it on Windows 10/11 with Microsoft 365 (Office 2021) and said other Office versions are likely affected too. - Check: in Outlook go to File > Office Account and compare the build with Microsoft's update guide for CVE-2024-21413, or check your patch management reports. Fix: 1. Install the Office/Outlook security updates from February 2024 or later (current Microsoft 365 Apps update channels include them), and make sure update channels aren't stalled by policy. 2. Block outbound SMB traffic to the internet at your firewall, so a clicked link can't send credentials to an outside server. 3. Keep email security filtering on, and treat unexpected links to file shares in emails as suspicious. 4. If you suspect a user clicked such a link before patching, reset that user's password and review their account sign-ins. Verify: every Outlook client reports a build at or above the fixed version in Microsoft's update guide, and your scanner no longer flags CVE-2024-21413. Sources: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413 https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/ https://nvd.nist.gov/vuln/detail/CVE-2024-21413 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21413