Despite moving aggressively to fix zero-day vulnerabilities in its software, Microsoft will have to move faster still to keep up with criminal hackers. One day before the company plans to release its July patch and fix two "browser-and-get-owned" vulnerabilities, a third "browse-and-get owned" flaw has been reported.

On Monday, Microsoft issued a Security Advisory about a previously undisclosed vulnerability in Office Web Components Spreadsheet ActiveX control (OWC 10 and OWC11).

"The vulnerability exists specifically in the Spreadsheet ActiveX Control and could allow an attacker who successfully exploited this vulnerability the same user rights as the local user," the Microsoft advisory states. "We are aware of limited, active attacks attempting to exploit this vulnerability."

Last week, Microsoft issued a Security Advisory about a vulnerability in its Video ActiveX Control.

Microsoft security engineer Fermin J. Serna said in a post on the company's Security Research & Defense blog that a "browse and get owned" scenario exists, but the user would have to visit a malicious Web site for this to happen.

Microsoft has provided a workaround, a "Fix It" link that disables the vulnerable components. It's unlikely that Microsoft will have time to test a fix to include in the patch it plans to issue tomorrow.

The two vulnerable components are not installed by default, but they can be installed with Office XP, Office 2003, Office 2007, BizTalk, ISA Server, or Office Accounting and Business Contact Manager.

On Windows Server 2003 and Windows Server 2008, a possible attack is likely to be less effective. That's because the default configurations for those two Windows operating systems include something called Enhanced Security Configuration, which prevents ActiveX controls from loading in the Internet Zone when browsing.

Users of Internet Explorer 7 or 8 who visit a malicious Web site attempting to exploit this vulnerability without the vulnerable components installed should see a gold bar prompt asking permission to install the components.

If that happens, just say no.

Black Hat is like no other security conference. It happens in Las Vegas, July 25-30. Find out more and register.