Microsoft Corp. has taken the rare step of warning about a serious security vulnerability it hasn't fixed yet.

The vulnerability disclosed Monday affects Internet Explorer users whose computers run the Windows XP or Windows Server 2003 operating software.

It can allow hackers to remotely take control of victims' machines. The victims don't need to do anything to get infected except visit a Website that's been hacked.

Security experts say criminals have been attacking the vulnerability for nearly a week.

Microsoft says it's working on a "patch," a software fix. Until that's released, the company is urging vulnerable users to disable the problematic part of its software, which can be done from Microsoft's Website.