Microsoft MSHTML flaw allows remote code execution via Office
Microsoft patched CVE-2021-40444, an MSHTML vulnerability in Windows actively exploited in the wild, enabling remote code execution via malicious Office documents.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2021-40444 as exploited in the wild.
On September 8, 2021, Microsoft disclosed CVE-2021-40444, a remote code execution vulnerability in the MSHTML rendering engine affecting multiple Windows versions. The vulnerability allows attackers to execute arbitrary code when a user opens a specially crafted Microsoft Office document containing a malicious ActiveX control. Microsoft confirmed active exploitation in the wild at the time of disclosure.
The Japan Information-technology Promotion Agency (IPA) issued this alert urging immediate application of Microsoft's September 2021 security updates. Prior to patch availability, Microsoft provided workarounds including disabling the installation of all ActiveX controls in Internet Explorer and implementing attack surface reduction rules in Microsoft Defender.
Given confirmed in-the-wild exploitation and the ease of delivery via Office documents, organizations should treat this as a critical patching priority. The vulnerability affects Windows Server 2008 through 2019, Windows 7 through 11, and various Windows 10 versions, making the attack surface substantial across enterprise environments.
Mentioned in this report
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/20210908-ms.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs