CVE-2021-40444

mediumpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.978 · 100 %ileexploit · weaponizedEURUUS
grimoire priorityP0 · Act now
Exploitable?
Yes · in the wild
CISA KEV · 35 exploits · weaponized
Likely / severe?
97.8% (100th) EPSS
CVSS 6.8 · medium
Is it mine?
153 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · fstec_bdu · msrc_csaf

added 2021-11-03remediate by 2021-11-17

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-27

Microsoft MSHTML Remote Code Execution Vulnerability

Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Microsoft Defender Antivirus and Microsoft Defender for Endpoint both provide detection and protections for the known vulnerability. Customers should keep antimalware products up to date. Customers who utilize automatic updates do not need to take additional action. Enterprise customers who manage updates should select the detection build 1.349.22.0 or newer and deploy it across their environments. Microsoft Defender for Endpoint alerts will be displayed as: “Suspicious Cpl File Execution”. Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs. Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability. UPDATE September 14, 2021: Microsoft has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. Please see the FAQ for important information about which updates are applicable to your system.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

02

cvss

Technical severity, 0–10. One row per scoring source.

8.8
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.8–8.8

v2.06.8mediumAV:N/AC:M/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 8.6 · impact 6.4
v2.06.8mediumAV:N/AC:M/Au:N/C:P/I:P/A:P/E:Hsecondary · CVSS-BT (t0sche)
v3.18.8highAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:Lsecondary · FSTEC (BDU) RU
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:Lsecondary · secure@microsoft.com USexploitability 2.8 · impact 5.3
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L/E:P/RL:O/RC:Csecondary · Microsoft Security Response Center US
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L/E:P/RL:O/RC:Csecondary · ENISA EU
v3.17.8highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · NVD / NIST USexploitability 1.8 · impact 5.9
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-22USprimaryCWE-94US
05

exploits (35)

Public proof-of-concept and weaponised exploit code.

06

affected products (153)

Products and version ranges known to be affected.

showing 20 of 153
07

advisories (1)

Vendor and ecosystem advisories describing this.

  • msrc_CVE-2021-40444Microsoft MSHTML Remote Code Execution Vulnerability2021-09-07csaf · msrc_csafUS

    To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

08

also known as (4)

Other names and identifiers for this entity.

09

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bdumsrc_csafNVDCVE.orgMITRE
published 2021-09-15modified 2026-08-10
11

references (17)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan