Skip to content
Fencer Vulns
high 7.5

CVE-2001-1088 in the critical feed json

Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the "Automatically put people I reply to in my address book" opt…

published 2001-06-05 25 y ago modified 2026-06-16 4 mo ago also EUVD-2001-1069

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
19.7%
EPSS 19.7% chance of exploitation in 30 days, percentile 97%
public exploits
1
Exploit-DB

Summary

Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the "Automatically put people I reply to in my address book" option enabled, do not notify the user when the "Reply-To" address is different than the "From" address, which could allow an untrusted remote attacker to spoof legitimate addresses and intercept email from the client that is intended for another user.

Timeline

  1. First public exploit (EDB-20899)
  2. Published

Exploit prediction

19.71% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-20899 Microsoft Outlook 97/98/2000/4/5 - Address Book Spoofing remote, 2001-06-05
  • securityfocus.com http://www.securityfocus.com/archive/1/188752 referenced PoC, tagged "exploit" by a source, unverified
  • securityfocus.com http://www.securityfocus.com/bid/2823 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.