Critical vulnerability in Microsoft Outlook (CVE-2024-21413)
Last updated January 17, 2026
Microsoft Outlook is the heart of daily communication for many organizations. This is precisely why vulnerabilities in Outlook are especially sensitive. In early 2024, two serious security vulnerabilities were made public that have been actively exploited.
At issue is a critical vulnerability in Microsoft Outlook itself and a related vulnerability in so-called Internet Shortcut Files. Together, they show how quickly a seemingly innocuous e-mail can turn into a serious security incident.
In this article, we explain what's going on, why this is relevant to your organization, and most importantly, what you should do specifically.
What is CVE-2024-21413 in Microsoft Outlook?
CVE-2024-21413 is a vulnerability in Microsoft Outlook that allows an attacker to bypass security measures. In certain scenarios, it is possible to execute code remotely without the user's deliberate consent.
That makes this vulnerability especially risky. A user does not have to actively open an attachment or click away a warning. A cleverly constructed e-mail can be enough to enable abuse.
For organizations, this means an increased risk of:
- malware infections
- data breach
- acquisition of user accounts
- lateral movement within the network
CVE-2024-21412 and Internet Shortcut Files
In addition to Outlook itself, CVE-2024-21412 is also relevant. This vulnerability is in Internet Shortcut Files (.url files). Attackers can use these to bypass Microsoft Defender SmartScreen.
This technique has been actively deployed by the APT group Water Hydra, particularly targeting traders in financial markets. The method of attack is technical, but the impact is simple to summarize: security alerts are not displayed or are displayed too late. Combined with Outlook, this significantly increases the risk. An e-mail with an innocent-looking link or attachment can still lead to the installation of malicious software.
Why updates make a difference here
Both vulnerabilities have been fixed by Microsoft through security updates. Systems that are fully updated are protected against these attack techniques. Not updating in this case means that known, actively exploited vulnerabilities remain open. This is not a theoretical risk, but a practical problem.
Updating Windows 10 and Windows 11 securely
Updating Windows is a necessary first step.
- First, open the Settings via the Windows logo and the gear icon. This is the central location for system management.
- Then go to Update and security and select Windows Update. This is where Windows automatically checks for updates.
- Install all available updates. This may take a while, depending on the system.
- Reboot the laptop or PC. This is necessary to make security patches actually active.
Don't skip that reboot. Many vulnerabilities are only really closed after rebooting.
Microsoft 365 Outlook update
Outlook itself should also be explicitly updated, especially in environments where updates are not automatic.
- Start Microsoft Outlook.
- Click on the top left File to open the account overview.
- Go to Office account or Account, depending on the version.
- Find the part Office updates and select Update now.
- Follow the on-screen instructions. It may be necessary to close Outlook temporarily.
- Restart Outlook once the updates are complete.
This ensures that security fixes for CVE-2024-21413 are actually active.
Additional security measures
Updates are necessary, but not sufficient. These vulnerabilities show again how important basic security remains.
Strong and unique passwords reduce the impact if an account does get compromised. In addition, be alert to phishing emails, especially when they feel unexpected or urgent. Make sure antivirus and endpoint security is active and up to date. And make regular backups of important data so that recovery remains possible after an incident.
What this means in practice
In practice, we at Mica IT see that organizations often think that “automatic updates” cover everything. This is far from always the case. Outlook updates regularly lag behind, especially on laptops that are rarely rebooted. Especially with vulnerabilities that are being actively exploited, that's a risk you don't want to take.
Let's get it checked out?
Frequently Asked Questions
What makes CVE-2024-21413 so serious?
This vulnerability can bypass security mechanisms without clear warnings to the user. This makes abuse harder to spot and more quickly successful.
Should I update Outlook if Windows is already up-to-date?
Yes. Windows updates and Microsoft 365 updates run through different processes. Both should be checked separately.
Is this vulnerability being actively exploited?
Yes. Microsoft and security researchers have confirmed that these vulnerabilities are being actively used by attackers.
Does this also apply to older Outlook versions?
Especially supported versions of Outlook have received updates. Older, unsupported versions pose an additional risk because patches for them no longer appear.
Is updating alone enough protection?
Updating is the most important step, but basic measures such as phishing awareness, antivirus and backups remain necessary.
