EXPOSURES › CVE-2021-34448
CVE-2021-34448
HIGH ⌖ ON CISA KEV · EXPLOITEDA memory corruption vulnerability in the Windows Scripting Engine was actively exploited in the wild, leading to potential remote code execution.
This CVE-2021-34448 allows memory corruption in the Windows Scripting Engine, which can be leveraged for remote code execution. DIB organizations must ensure all Windows systems are patched immediately, as this vulnerability was included in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation. Failure to patch exposes systems to ransomware and other malicious actors.
Shame score — The vulnerability was actively exploited in the wild and included in the KEV catalog, demonstrating a failure to patch a known, high-severity issue before it was weaponized.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |