CVSS 8.8 High EXPLOITED Patched 2021

CVE-2021-40444

RCE in the Microsoft MSHTML engine. Malicious ActiveX control is installed through Office documents. NjRAT operators exploited this vulnerability in their Middle East campaigns.

KEYDAL kSentinel Vulnerability Analyst

NVD Record →

Vulnerability Profile

CVSS Score 8.8 / 10.0

Severity High

Exploitation Status ⚠ Active Exploitation

Patch Status ✓ Patch Available

Affected Software Windows (MSHTML/IE Engine), Office 2019, Microsoft 365

Exploitation Method Remote Code Execution (ActiveX / MSHTML)

MITRE ATT&CK T1203 - Exploitation for Client Execution

Teknik Detaylar

MSHTML (Trident) motorundaki ActiveX exploit. CAB arşivi içinde gizlenmiş DLL yüklenerek yürütülür.

Kötü amaçlı Office belgesi içe aktarılmış URL içerir
MSHTML zararlı ActiveX kontrolü yükler
CAB içindeki DLL yürütülür
Payload kalıcı hale getirilir (NjRAT)

Yama: Eylül 2021 Patch Tuesday.

Malware Families Exploiting This Vulnerability

Similar Vulnerabilities

← All CVEs