Security researchers have identifed an unpatched vulnerability in Windows. The exploit effects all supported versions of Windows with the exception of Windows 2003. The vulnerability resides in a security bug in Microsoft XML Core Services, specifically and unspecified security bug in the XMLHTTP 4.0 ActiveX Control.

The vulnerability allows hackers to inject malware into a users PC thats are running Internet Explorer when the visitor visits a webpage with the malicious code. The security firm Secunia says that the vulnerability is being actively exploited by hackers.

Microsoft has posted an advisory that suggests some possible workarounds.