⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2021-11-17.
CVE-2021-40444
Severity
7.8HIGH
EPSS
94.3%
top 0.05%
CISA KEV
KEVRansomware
Added 2021-11-03
Due 2021-11-17
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedSep 15
KEV addedNov 3
KEV dueNov 17
Latest updateJun 27
CISA Required Action: Apply updates per vendor instructions.
Description
Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents.
An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accounts are con…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:LExploitability: 2.8 | Impact: 5.3
Affected Packages33 packages
▶CVEListV5microsoft/windows_server_2008_service_pack_2_(server_core_installation)6.0.0 — 6.0.6003.21218+1
Patches
🔴Vulnerability Details
5📋Vendor Advisories
2🕵️Threat Intelligence
35Fortinet▶
LokiBot Campaign Targets Microsoft Office Document Using Vulnerabilities and Macros | FortiGuard Labs↗2023-07-12