EXPOSURES › CVE-2019-0676
CVE-2019-0676
HIGH ⌖ ON CISA KEV · EXPLOITEDMicrosoft Internet Explorer had an information disclosure vulnerability allowing attackers to test for file presence on disk.
This vulnerability allowed attackers to probe for files on a system, potentially revealing sensitive data or system configurations. DIB organizations must ensure legacy browsers are patched or disabled, as unpatched CVEs in widely deployed software remain a high-risk compliance gap. The failure highlights the danger of relying on outdated software without active patch management.
Shame score — A known vulnerability in a widely deployed product that was actively exploited (KEV) demonstrates negligence in patch management and reliance on outdated software.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |