CVE-2021-38646: high-severity vulnerability in Microsoft 365 Apps for Enterprise
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply updates per vendor instructions.
A vulnerability in Microsoft Office's Access Connectivity Engine allows an attacker to execute malicious code on a computer by tricking a user into opening a specially crafted file. This can lead to complete system compromise.
The vulnerability exists in the Access Connectivity Engine component when processing malformed database files or queries. An attacker can craft a malicious Office document that triggers unsafe code execution during file parsing, bypassing security boundaries and achieving arbitrary code execution in the user's security context.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.