CVE-2021-33742

A remote code execution vulnerability in Microsoft Windows MSHTML was actively exploited in the wild, allowing attackers to execute arbitrary code on unpatched systems.

This unpatched RCE vulnerability in the MSHTML platform was listed in CISA's KEV catalog, indicating it was actively exploited in the wild. For DIB organizations, this means any unpatched Windows systems are at risk of remote code execution, which can lead to full system compromise, data exfiltration, and ransomware deployment. The key takeaway is to ensure all Windows systems are patched promptly and to monitor for exploitation attempts targeting the MSHTML component.

Shame score — The vulnerability was actively exploited in the wild and included in CISA's KEV catalog, demonstrating that it was a known, unpatched flaw that attackers leveraged for malicious purposes.