EXPOSURES › CVE-2016-0189
CVE-2016-0189
HIGH ⌖ ON CISA KEV · EXPLOITEDA memory corruption flaw in Internet Explorer's JScript and VBScript engines allowed remote code execution via malicious websites.
This vulnerability enabled attackers to execute arbitrary code on systems running Internet Explorer by visiting a specially crafted webpage. For DIB organizations, this represents a critical exposure where legacy browsers or unpatched systems could be compromised without user interaction, violating CMMC/NIST 800-171 requirements for patch management and secure configuration. Organizations must ensure all browsers are updated to the latest patches and consider disabling or replacing legacy browsers like Internet Explorer.
Shame score — A known memory corruption vulnerability in a widely used browser was actively exploited in the wild, demonstrating severe negligence in patch management and system hardening.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |