Microsoft said on Monday that attackers are exploiting a zero-day ActiveX vulnerability in the Snapshot Viewer for Microsoft Access.