CVE-2021-27059

Microsoft Office contained an unpatched remote code execution vulnerability that was actively exploited in the wild.

Microsoft Office had a remote code execution vulnerability that was not patched before being exploited, allowing attackers to execute arbitrary code on systems. DIB organizations must ensure timely patching of Office products to prevent similar compromises, as unpatched vulnerabilities are a primary vector for ransomware and data breaches. This failure highlights the critical importance of maintaining up-to-date security patches across all software assets.

Shame score — The vulnerability remained unpatched long enough to be actively exploited in the wild, demonstrating a failure in Microsoft's patch management and vulnerability disclosure processes.