CVE-2014-4123

An unpatched privilege escalation flaw in Microsoft Internet Explorer allowed remote attackers to gain elevated privileges via a crafted website.

Internet Explorer, an end-of-life and unsupported browser, contained a critical vulnerability that enabled remote attackers to escalate privileges through a malicious website. DIB organizations must care because relying on or supporting such obsolete, unpatched software exposes systems to active exploitation, violates CMMC/NIST 800-171 requirements for patching known vulnerabilities, and risks compliance failures. The organization must immediately remove Internet Explorer from all environments and ensure all software is supported and patched.

Shame score — Microsoft shipped an end-of-life, unsupported product with a known, actively exploited privilege escalation vulnerability for years, demonstrating severe negligence in maintaining a secure software supply chain.