Skip to content
Trending
Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface
FIX MS Outlook Zero-Click RCE Flaw Executes as Email is Opened

FIX MS Outlook Zero-Click RCE Flaw Executes as Email is Opened

Written By Anoop C Nair
Last Updated June 14, 2024
Posted In Microsoft 365
SHARE

Microsoft announced the Outlook Zero-Click RCE Flaw as part of CVE-2024-30103, Microsoft Outlook Remote Code Execution Vulnerability, released as part of June Patch Tuesday.

This must be fixed as an urgent bulletin as soon as possible to avoid any damage to your organization. As per Microsoft, an attacker who successfully exploited this vulnerability could bypass Outlook registry block lists and enable the creation of malicious DLL files.

This vulnerability is very dangerous because it doesn’t require a click to execute. Instead, the execution gets initiated when an affected email is just opened.

Morphisec’s detailed analysis shows that the Outlook Zero-Click RCE Flaw lies in how MS Outlook processes certain email components.

Patch My PC
FIX MS Outlook Zero-Click RCE Flaw Executes as Email is Opened Fig. 1
FIX MS Outlook Zero-Click RCE Flaw Executes as Email is Opened Fig. 1

FIX MS Outlook Zero-Click RCE Flaw Executes as Email is Opened

Microsoft already released the fix for this vulnerability as part of the June 11, 2024, patch Tuesday. The following table details the fixed Outlook versions and other Office apps.

Microsoft 365 App ChannelsBuild Versions
Current Channel: Version 2405 (Build 17628.20144)
Monthly Enterprise Channel: Version 2404 (Build 17531.20190)
Monthly Enterprise Channel: Version 2403(Build 17425.20258)
Semi-Annual Enterprise Channel (Preview): Version 2402(Build 17328.20414)
Semi-Annual Enterprise Channel: Version 2308 (Build 16731.20716)
Semi-Annual Enterprise Channel: Version 2302 (Build 16130.21026)
Office 2021 Retail: Version 2405 (Build 17628.20144)
Office 2019 Retail: Version 2405 (Build 17628.20144)
Office 2016 Retail: Version 2405 (Build 17628.20144)
Office LTSC 2021 Volume Licensed: Version 2108 (Build 14332.20721)
Office 2019 Volume Licensed: Version 1808 (Build 10411.20011)
FIX MS Outlook Zero-Click RCE Flaw Executes as Email is Opened Table 1.0

Update Outlook Client Immediately

Let’s quickly update the Windows Outlook client to mitigate the issue immediately. Open the Outlook client app and follow the steps. You can use SCCM or Intune (more details in the below section) to keep the Office applications up to date and fix this vulnerability.

  • Select File -> Office Account -> Office Updates and select the Update Now button.
FIX MS Outlook Zero-Click RCE Flaw Executes as Email is Opened Fig. 2
FIX MS Outlook Zero-Click RCE Flaw Executes as Email is Opened Fig. 2

Intune Policy to Force Office Apps to a Target Version

Let’s check the Intune Policy to Force Office Apps to a Target Version. You can use the Settings Catalog (more details Create Intune Settings Catalog Policy). Settings Catalog supports Windows device platforms.

There are other options to fix this issue with Microsoft Outlook. You can use the Intune proactive remediation, but it needs an additional license.

NOTE! You can also use the Custom Compliance policy in Intune to force users to update to the latest version of Office Apps (including Outlook client). Once the users are updated, they can use the organization’s resources!

  • Sign in to the Microsoft Intune admin center
  • Select Devices > Configuration profiles > Create profile.

In Create Profile, You can select Platform: Select Windows 10 and later and Profile: Select Settings catalog (preview). Click on the Create button. For Example – we have selected the platform Windows 10 and later.

  • Search for the Target Version and set the policy
  • Target Version Enabled:
  • Update Version (Device) to 17628.20144 or any Office version as per your Office channel. Refer to the above table to get more details.

In the following blog post, we discussed many other options, such as Task Scheduler and Auto Patch method. For more details, refer to FIX Zero Day Security Vulnerability For Outlook HTMD Blog (anoopcnair.com).

FIX MS Outlook Zero-Click RCE Flaw Executes as Email is Opened Fig.2
FIX MS Outlook Zero-Click RCE Flaw Executes as Email is Opened Fig.2

Author

Anoop is Microsoft MVP! He is a Solution Architect in enterprise client management with more than 17 years of IT experience (calculation done in the year 2018). He is a Blogger, Speaker, and Local User Group Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about technologies like SCCM, SCOM, Windows 10, Azure AD, Microsoft Intune, RMS, Hyper-V etc…

Written by

Anoop C Nair is Workplace Technology solution architect with 25+ years of experience in global enterprise organizations such as JP Morgan, Capgemini, etc. Microsoft Certified Trainer. Microsoft MVP from 2015 onwards for consecutive 11+ years! He also conducts Intune and modern workplace tech training for enterprise organizations. He is Blogger, Speaker, and Founder of HTMD Community and HTMD Conference. His main focus is on Device Management technologies like Intune, Windows, Cloud PC. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security.

Discussion

Join the discussion

Your email address will not be published. Required fields are marked *

Related guides

Microsoft 365

Purchase Windows 365 Flex High Performance Cloud PC Free Trial License

Key Takeaways In this article, I will explain how to purchase a Windows 365 Flex High Performance Cloud PC Free Trial License. Microsoft now offers a Windows 365 Flex 32 vCPU, 128 GB RAM, 2 TB Storage Cloud PCs free trial, giving organisations an excellent opportunity to evaluate one of the most powerful Cloud PC […]

VK Vaishnav K 6 min read
Intune

Microsoft Intune Portal No Longer Supports Microsoft 365 Apps Policy Management

Key Takeaways Microsoft Intune Portal No Longer Supports Microsoft 365 Apps Policy Management! Starting with the Intune June 2026 (2606) service release, Microsoft will remove the ability to create or edit Microsoft 365 Apps policies in the Intune admin center. Administrators must use the Microsoft 365 Apps admin center for policy management. Existing policies, permissions, […]

AC Anoop C Nair 6 min read
Microsoft 365

Microsoft Announces Major Microsoft 365 Pricing and Packaging Changes Coming in Mid-2026

Key Takeaways Microsoft Announces Major Microsoft 365 Pricing and Packaging Changes Coming in Mid-2026! Microsoft is introducing major updates to Microsoft 365, Office 365, and EMS suites in mid-2026, adding several advanced security and management capabilities directly into existing plans. New additions include Defender for Office 365 P1, Time-of-Click Protection for malicious URL scanning, Intune […]

AC Anoop C Nair 4 min read