CVE-2001-0660: Outlook Web Access (OWA) in Microsoft Exchange 5.5, SP4 and earlier, allows remote attackers to identify va...

Security readout for executives and security teams

This old Microsoft Exchange OWA flaw could let a remote user confirm valid email addresses from the Global Address List. That is mainly an information-disclosure issue, but it can support targeted phishing, password attacks, and privacy exposure if legacy OWA remains reachable. Exposure is most likely where Microsoft Exchange 5.5 SP4 or earlier still runs OWA, especially if reachable from the internet or untrusted networks. Treat this as a legacy-exposure cleanup item unless Exchange 5.5 OWA is internet-facing. If exposed, prioritize remediation because the flaw can feed targeted attacks even without code execution. Mitigation focus: Check Microsoft MS01-047 and Q307195 guidance for the vendor-provided update or workaround.; Retire unsupported Exchange 5.5 OWA where business operations allow.; Restrict OWA access to trusted networks if legacy service cannot be removed quickly..

Prepared

Jul 1, 2026, 07:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.