Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2020-17119

20
FAUCET Score

CVE-2020-17119 is a high-severity information disclosure vulnerability affecting Microsoft Outlook, Microsoft Office, and Microsoft 365 Apps. With a CVSS score of 7.5, it can be exploited remotely without user interaction, potentially leading to the disclosure of sensitive information. While no public exploit code is available and it's not listed in CISA's KEV catalog, its EPSS score indicates a higher than average probability of exploitation. The vulnerability has garnered significant community discussion and media coverage, suggesting notable attention despite the lack of active exploitation.

Impacted Technologies

VendorProductVersion(s)CPE
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*
2019CPE matchmatch criteria
cpe:2.3:a:microsoft:office:2019:*:*:*:*:macos:*:*
2010CPE matchmatch criteria
cpe:2.3:a:microsoft:outlook:2010:sp2:*:*:*:*:*:*
2013CPE matchmatch criteria
cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:*:*:*:*
2016CPE matchmatch criteria
cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

6.5MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
2.8
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
4.13%
Probability of exploitation in next 30 days
EPSS Percentile
89.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0413 is in the 82nd percentile among its peer group of 51,553 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (13)

microsoftpatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: Microsoft Office 2019 for 32-bit editionsFixed in: https://aka.ms/OfficeSecurityReleases
microsoftpatch availablevia msrc
Product: Microsoft Office 2019 for 64-bit editionsFixed in: https://aka.ms/OfficeSecurityReleases
microsoftpatch availablevia msrc
Product: Microsoft 365 Apps for Enterprise for 32-bit SystemsFixed in: https://aka.ms/OfficeSecurityReleases
microsoftpatch availablevia msrc
Product: Microsoft 365 Apps for Enterprise for 64-bit SystemsFixed in: https://aka.ms/OfficeSecurityReleases
microsoftpatch availablevia msrc
Product: Microsoft Office 2019 for Mac
View patch
microsoftpatch availablevia msrc
Product: Microsoft Outlook 2016 (32-bit edition)
View patch
microsoftpatch availablevia msrc
Product: Microsoft Outlook 2016 (64-bit edition)
View patch
microsoftpatch availablevia msrc
Product: Microsoft Outlook 2013 Service Pack 1 (32-bit editions)
View patch
microsoftpatch availablevia msrc
Product: Microsoft Outlook 2013 Service Pack 1 (64-bit editions)
View patch
microsoftpatch availablevia msrc
Product: Microsoft Outlook 2010 Service Pack 2 (32-bit editions)
View patch
microsoftpatch availablevia msrc
Product: Microsoft Outlook 2010 Service Pack 2 (64-bit editions)
View patch
microsoftpatch availablevia msrc
Product: Microsoft Outlook 2013 RT Service Pack 1

Vendor Advisories (1)

microsoft2020-Dec/CVE-2020-17119Important

Microsoft Outlook Information Disclosure Vulnerability

Dec 8, 2020

References

portal.msrc.microsoft.com / en-US/security-guidance/advisory/CVE-2020-17119
PatchVendor Advisory
msrc.microsoft.com / update-guide/vulnerability/CVE-2020-17119