CVE-2021-38646KEV · OVERDUE

Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

High · published September 15, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 94.7th percentile for exploit probability.

1650
days past CISA
deadline
CVSS v3.1
7.8
EPSS
8%
Percentile
94.7
In the wild
Confirmed
What it is

🚨 A single crafted database call is all it takes for an attacker to execute arbitrary code on your system! This vulnerability in the Microsoft Office Access Connectivity Engine could spell disaster if left unaddressed. ⚡ Think of it like a restaurant where a rogue chef can sneak into the kitchen and prepare a dish that poisons the patrons — a small entry point with devastating consequences if exploited! An attacker could leverage this vulnerability to gain full remote access, allowing them to read sensitive data, modify important records, or even completely take control of your system. This could lead to serious data breaches and operational disruptions, making it critical to act swiftly!

Put simply

Think of it like a restaurant where a rogue chef can sneak into the kitchen and prepare a dish that poisons the patrons — a small entry point with devastating consequences if exploited! The vulnerability lies in the way Microsoft Office Access Connectivity Engine processes database calls. By sending specially crafted input, an attacker can trigger remote code execution, bypassing normal security measures.

What to do

An attacker could leverage this vulnerability to gain full remote access, allowing them to read sensitive data, modify important records, or even completely take control of your system. This could lead to serious data breaches and operational disruptions, making it critical to act swiftly! To protect yourself, immediately apply the latest security patches from Microsoft, specifically targeting the affected versions. Ensure that your systems are configured to limit Access Connectivity Engine usage where possible, and conduct a thorough security audit to identify any other potential vulnerabilities. You've got this! With these steps, you'll shore up your defenses and keep your systems safe. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.07987 · 94.7th percentile
Published
2021-09-15T16:15Z
KEV added
2022-03-28 · due 2022-04-18
Affected products (6)
ProductVersionsFixed in
microsoft/365_appsall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/office_2016all versions—
microsoft/office_2016all versions—
microsoft/office_2019all versions—
References (3)
EPSS history
Timeline
  • 28 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 18
    kev
  • 15 SEP 11:24Z
    Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
    cvelistv5