Microsoft was first notified of a dangerous ActiveX vulnerability last year, but is working toward a quick fix after it learned of active attacks underway.