Microsoft Office Remote Code Execution Vulnerability
Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An attacker with administrative privileges, remotely over the network, if a user is tricked into opening a malicious file or link, can fully compromise the system — steal data, tamper with it and take it offline.
Microsoft Office Remote Code Execution Vulnerability
Techniques marked “observed” are corroborated by threat intelligence; the rest are inferred from the weakness type (CWE) and attack vector.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
These techniques were analysed against this CVE's real-world exploitation — the matching entries in the ATT&CK chain above are marked “observed”.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
Implement robust email gateway filtering to block suspicious attachments and ensure user awareness training on recognizing and avoiding malicious Office documents. Configure endpoint security solutions to monitor for anomalous process execution originating from Office applications, such as unexpected child processes. Enforce the principle of least privilege for all users to minimize the potential impact of successful exploitation.
The permanent resolution involves promptly applying the security updates released by Microsoft for all affected Office products. Administrators should deploy the latest patches through Windows Update, WSUS, or other enterprise patch management solutions. Ensure that all instances of Microsoft Office and Microsoft 365 Apps are updated to a version that includes the fix for CVE-2021-27059.
An attacker could exploit this vulnerability by tricking a user into opening a specially crafted Microsoft Office document. Successful exploitation grants the attacker the ability to execute arbitrary code with the privileges of the logged-on user. This can lead to full system compromise, data exfiltration, or further network penetration, posing significant risks to business operations and data confidentiality.
No CWE classification has been assigned.
Other CVEs affecting office
Microsoft Outlook Remote Code Execution Vulnerability
Microsoft Outlook Elevation of Privilege Vulnerability
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.
A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".
Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized Memory Use Vulnerability."
The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, and R2 SP2, Commerce Server 2002 SP4, Commerce Server 2007 SP2, Commerce Server 2009 Gold and R2, Host Integration Server 2004 SP1, Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP2, and Visual Basic 6.0 Runtime allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption, aka "MSCOMCTL.OCX RCE Vulnerability."