EXPOSURES › CVE-2020-0674
CVE-2020-0674
HIGH ⌖ ON CISA KEV · EXPLOITEDMicrosoft Internet Explorer's Scripting Engine had a memory corruption vulnerability allowing remote code execution.
A memory corruption flaw in IE's Scripting Engine enabled remote code execution as the current user. DIB orgs must care because unpatched IE remains a high-risk attack vector, especially given its inclusion in the CISA KEV catalog. Organizations should ensure IE is fully patched or disabled, and avoid relying on legacy browsers for sensitive operations.
Shame score — A known memory corruption vulnerability in a widely deployed legacy browser was actively exploited in the wild, demonstrating the severe risks of unpatched legacy software.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Internet Explorer contains a memory corruption vulnerability due to the way the Scripting Engine handles objects in memory. Successful exploitation could allow remote code execution in the context of the current user.
"Microsoft Internet Explorer contains a memory corruption vulnerability..."
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |