EXPOSURES › CVE-2014-6332
CVE-2014-6332
HIGH ⌖ ON CISA KEV · EXPLOITEDA 2014 OLE automation array RCE in Windows was actively exploited in the wild and remains in CISA's KEV catalog.
This 2014 remote code execution flaw in Windows OLE was never patched and was actively exploited in the wild, demonstrating the severe risk of unpatched legacy vulnerabilities. DIB organizations must ensure all Windows systems are fully patched and monitored for KEV catalog entries to prevent similar compromises. The failure highlights the critical importance of maintaining a rigorous patch management program and avoiding reliance on outdated operating systems.
Shame score — A known, unpatched RCE vulnerability remained in the KEV catalog for years, showing Microsoft's failure to patch a critical flaw and the severe consequences of relying on legacy systems.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |