EXPOSURES › CVE-2017-11826
CVE-2017-11826
HIGH ⌖ ON CISA KEV · EXPLOITEDMicrosoft Office had a remote code execution vulnerability that was actively exploited in the wild.
A remote code execution vulnerability in Microsoft Office allowed attackers to run arbitrary code in the context of the current user. This failure is critical for DIB organizations because it represents an unpatched, actively exploited vulnerability that could lead to data breaches or ransomware infections if not mitigated through strict patch management and application whitelisting.
Shame score — The vulnerability was actively exploited in the wild (KEV) and linked to ransomware campaigns, indicating a severe failure in patch management and threat detection.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |