Microsoft Outlook For Android vulnerabilities
9 vulnerabilities
Known vulnerabilities in Microsoft Outlook For Android, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-21259microsoftmicrosoft outlook for android+1
EPSS score1.16%
Microsoft Outlook Spoofing VulnerabilityCVE-2025-29805microsoftmicrosoft outlook for android+1EPSS score1.56%
Exposure of sensitive information to an unauthorized actor in Outlook for Android allows an unauthorized attacker to disclose information over a network.CVE-2022-24480microsoftmicrosoft outlook for android+1EPSS score0.56%
Outlook for Android Elevation of Privilege VulnerabilityCVE-2024-26204microsoftmicrosoft outlook for android+1EPSS score2.12%
Outlook for Android Information Disclosure VulnerabilityCVE-2024-43604microsoftmicrosoft outlook for android+1EPSS score1.16%
Outlook for Android Elevation of Privilege VulnerabilityCVE-2019-1460microsoftmicrosoft outlook for android+1EPSS score1.44%
A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android Spoofing Vulnerability'.CVE-2019-1105microsoftmicrosoft outlook for androidEPSS score1.82%
A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim.
The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on the affected systems and run scripts in the security context of the current user.
The security update addresses the vulnerability by correcting how Outlook for Android parses specially crafted email messages.CVE-2019-1084microsoftexchange_server+18EPSS score5.33%
An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.CVE-2026-26133microsoft365_copilot+29EPSS score0.56%
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.