EXPOSURES › CVE-2021-38646
CVE-2021-38646
CRITICAL ⌖ ON CISA KEV · EXPLOITEDA Microsoft Office vulnerability allowed authenticated users to inject SQL and potentially execute arbitrary code remotely, actively exploited in ransomware attacks.
CVE-2021-38646 in the Microsoft Office Access Connectivity Engine enables unauthorized data access and potential remote code execution via crafted report parameters. DIB organizations using vulnerable Office versions face significant compliance risk (CMMC, NIST 800-171) and potential data breaches; immediate patching is critical.
Shame score — The vulnerability's exploitation in active ransomware campaigns and potential for remote code execution demonstrates a significant and avoidable security lapse.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |