CVE-2022-27105: InMailX Outlook Plugin < 3.22.0101 is vulnerable to Cross Site Scripting (XSS).

Security readout for executives and security teams

CVE-2022-27105 affects InMailX Outlook Plugin versions before 3.22.0101. Connection names are not sanitized in the Outlook tab, allowing HTML or JavaScript to run inside users' Outlook. The source says this requires a local user or network administrator position. Business impact depends on how widely InMailX is installed and trusted in Outlook. Exposure is limited to environments using the InMailX Outlook Plugin below 3.22.0101. The bundle does not identify CPEs, deployment prevalence, or whether hosted services are involved. Inventory Outlook add-ins and InMailX plugin versions on managed endpoints. Prioritize this if InMailX is deployed broadly or connection configuration is delegated to local administrators. Without active exploitation evidence or a severity score, treat it as a controlled endpoint exposure rather than an emergency, but remove outdated plugin versions promptly. Mitigation focus: Inventory endpoints for InMailX Outlook Plugin installations.; Check vendor guidance for fixed or supported versions.; Upgrade installations below 3.22.0101 if a vendor-supported release is available..

Prepared

Jun 2, 2026, 02:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.