CVE-2014-1776

A memory corruption flaw in Internet Explorer allowed remote attackers to execute code as the current user.

This unpatched vulnerability was actively exploited in the wild, enabling remote code execution without requiring a zero-day exploit. DIB organizations must ensure legacy browsers are patched or disabled, as reliance on unpatched software violates CMMC/NIST 800-171 requirements for timely patching and vulnerability management.

Shame score — Microsoft failed to patch a known memory corruption vulnerability for years, allowing it to be actively exploited in the wild, which demonstrates severe negligence and avoidable risk.