CVE-2001-0538

CRITICAL ⚠ Exploit

Microsoft Outlook View ActiveX Control in Microsoft Outlook 2002 and earlier allows remote attackers to execute arbitrary commands via a malicious HTML e-mail message or web page.

Affects 1 product across 1 vendor.

BCS8.97
CVSS 2.010.0
EPSS52.9%
Percentile99th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity.
◆ SAGE Intelligence — CITED Relevance Research Team

A critical vulnerability in Microsoft Outlook 2002 and earlier versions allows remote attackers to execute arbitrary commands through a malicious HTML email or web page using the Outlook View ActiveX Control.

BSID: BS-2001-GLOBAL-172593-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2001-0538?
A critical vulnerability in Microsoft Outlook 2002 and earlier versions allows remote attackers to execute arbitrary commands through a malicious HTML email or web page using the Outlook View ActiveX Control.
What is the CVSS score for CVE-2001-0538?
CVE-2001-0538 has CVSS 10.0 (Critical). Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. EPSS: 52.9%.
Is CVE-2001-0538 actively exploited?
Public exploit available for CVE-2001-0538. Exploitation risk elevated.
How do I remediate CVE-2001-0538?
Priority: IMMEDIATE.
What systems are affected by CVE-2001-0538?
CVE-2001-0538 affects: Microsoft.
Vulnerability Details
CVE IDCVE-2001-0538
BSIDBS-2001-GLOBAL-172593-C BreachSpider Global ID
CVSS VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Published2001-08-14
Last Modified2026-04-16
ICS Relevance0%
SourceNVD
Official Description

Microsoft Outlook View ActiveX Control in Microsoft Outlook 2002 and earlier allows remote attackers to execute arbitrary commands via a malicious HTML e-mail message or web page.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The attack vector involves sending a specially crafted HTML email or visiting a malicious web page that contains the vulnerable ActiveX control. When the user opens the email or visits the page, the control is executed, leading to arbitrary code execution on the victim's system.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductFixed Version
Microsoft Outlook —
Remediation

No patch URL on record. Monitor vendor security advisories directly.

Threat Intelligence
● Threat Intelligence Validated: August 2026 | Threat Age: 9121 Days
CISA KEVNot in KEV catalog
Public Exploit⚠ Available — Reference
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
Related CVEs affecting Microsoft
CVE-2001-0045 10.0 The default permissions for the RAS Administration key in Windows NT 4.0 allo... CVE-2000-0788 10.0 The Mail Merge tool in Microsoft Word does not prompt the user before executi... CVE-2000-1034 10.0 Buffer overflow in the System Monitor ActiveX control in Windows 2000 allows ... CVE-2001-0147 10.0 Buffer overflow in Windows 2000 event viewer snap-in allows attackers to exec... CVE-2002-0736 10.0 Microsoft BackOffice 4.0 and 4.5, when configured to be accessible by other s...
View all Microsoft CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →