CVE-2021-42292KEV · OVERDUE

Microsoft Excel Security Feature Bypass

High · published November 10, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 98.7th percentile for exploit probability.

1788
days past CISA
deadline
CVSS v3.1
7.8
EPSS
43%
Percentile
98.7
In the wild
Confirmed
What it is

⚡ Microsoft Excel is at risk, and attackers can bypass security features with ease! This vulnerability is a game-changer for anyone relying on those Excel spreadsheets. 🔥 Think of this vulnerability like a restaurant with a faulty security system that lets anyone sneak into the kitchen without a key. You know, that place where all the secret recipes are kept and the magic happens? An attacker could exploit this vulnerability to execute arbitrary code, giving them access to sensitive information or even allowing them to completely take over your system. Imagine someone making a meal with your secret ingredients when you thought the kitchen was closed!

Put simply

Think of this vulnerability like a restaurant with a faulty security system that lets anyone sneak into the kitchen without a key. You know, that place where all the secret recipes are kept and the magic happens? CVE-2021-42292 is a security feature bypass vulnerability in Microsoft Excel that allows attackers to circumvent security protections and execute unauthorized code within the Excel environment.

What to do

An attacker could exploit this vulnerability to execute arbitrary code, giving them access to sensitive information or even allowing them to completely take over your system. Imagine someone making a meal with your secret ingredients when you thought the kitchen was closed! To protect yourself, ensure you apply the latest security updates from Microsoft immediately. Additionally, consider implementing strict file handling policies to mitigate the risk when opening files from untrusted sources. Don't let your guard down! You've got this! 🛡️ Stay vigilant and keep your Excel spreadsheets secure!

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.43005 · 98.7th percentile
Published
2021-11-10T06:19Z
KEV added
2021-11-17 · due 2021-12-01
Affected products (15)
ProductVersionsFixed in
microsoft/365_appsall versions—
microsoft/excelall versions—
microsoft/excelall versions—
microsoft/excelall versions—
microsoft/excelall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/office_2016all versions—
microsoft/office_2016all versions—
microsoft/office_2019all versions—
microsoft/office_2019all versions—
microsoft/office_2021all versions—
microsoft/office_2021all versions—
microsoft/office_2021all versions—
References (3)
EPSS history
Timeline
  • 17 NOV 00:00Z
    Added to CISA KEV — remediate by Dec 1
    kev
  • 10 NOV 00:47Z
    Microsoft Excel Security Feature Bypass Vulnerability
    cvelistv5