MSCOMCTL.OCX TabStrip ActiveX Remote Code Execution
Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An unauthenticated attacker, remotely over the network, if a user is tricked into opening a malicious file or link, can fully compromise the system — steal data, tamper with it and take it offline.
The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, and R2 SP2, Commerce Server 2002 SP4, Commerce Server 2007 SP2, Commerce Server 2009 Gold and R2, Host Integration Server 2004 SP1, Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP2, and Visual Basic 6.0 Runtime allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption, aka "MSCOMCTL.OCX RCE Vulnerability."
Inferred from the weakness type (CWE) and how the flaw is reached — the techniques an attacker would chain to exploit this. Real-world corroboration appears here as threat intel is folded in.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Named threat actors and observed ATT&CK techniques appear here as intel feeds are folded in — the ATT&CK chain above stays inferred until then.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
To reduce immediate risk, administrators should configure web browsers and Office applications to disable or prompt before running ActiveX controls, and enable Office Protected View. Deploy email and web gateway filters to block suspicious attachments or URLs that could exploit this vulnerability. Enhanced monitoring for unusual process launches or network activity on systems running MSCOMCTL.OCX is also recommended.
The permanent resolution requires applying the specific security updates released by Microsoft to address this vulnerability. Consult Microsoft Security Bulletin MS12-060 for the appropriate patches for all affected products, including various versions of Microsoft Office, SQL Server, Commerce Server, Host Integration Server, Visual FoxPro, and Visual Basic 6.0 Runtime. Ensure all listed affected components are updated to prevent system-state corruption.
A remote attacker can achieve arbitrary code execution by tricking a user into opening a specially crafted document or visiting a malicious web page. This grants the attacker full control over the compromised system, allowing them to install malware, steal sensitive data, or disrupt operations. The technical and business consequences include severe data breaches, complete system compromise, and significant operational downtime.
No CWE classification has been assigned.
Other CVEs affecting commerce server
Microsoft Outlook Elevation of Privilege Vulnerability
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".
Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."