CVE
CVE-2021-40444
- First Reported
- Sep 9, 2021
- Latest Reported
- Oct 21, 2026
CVE Enrichment
- CVSS
- 8.8 HIGH
- EPSS
- 97.84%
- EPSS Percentile
- 99.91%
- CISA KEV
- YES — Known Exploited Vulnerability
Description
Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Microsoft Defender Antivirus and Microsoft Defender for Endpoint both provide detection and protections for the known vulnerability. Customers should keep antimalware products up to date. Customers who utilize automatic updates do not need to take additional action. Enterprise customers who manage updates should select the detection build 1.349.22.0 or newer and deploy it across their environments. Microsoft Defender for Endpoint alerts will be displayed as: “Suspicious Cpl File Execution”. Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs. Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability. UPDATE September 14, 2021: Microsoft has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. Please see the FAQ for important information about which updates are applicable to your system.
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- secure@microsoft.com
- Published
- 15-Sep-2021 19:15
- Last Modified
- 11-Aug-2026 03:19
- EPSS Date
- 2026-10-19
- CWE
- CWE-22
CVSS Vector
CVSS:3.1 AV:N /
AC:L /
PR:N /
UI:R /
S:C /
C:L /
I:H /
A:L
CISA KEV Details
- Date Added
- 2021-11-03
- Remediation Due
- 2021-11-17
- Known Ransomware Campaign Use
- Known
- Required Action
- Apply updates per vendor instructions.
- Notes
- https://nvd.nist.gov/vuln/detail/CVE-2021-40444
Affected Products / Versions
- microsoft / windows_10_1507
Version / affected range: * · before (exclusive) 10.0.10240.19060
cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:* - microsoft / windows_10_1607
Version / affected range: * · before (exclusive) 10.0.14393.4651
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:* - microsoft / windows_10_1809
Version / affected range: * · before (exclusive) 10.0.17763.2183
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:* - microsoft / windows_10_1909
Version / affected range: * · before (exclusive) 10.0.18363.1801
cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:* - microsoft / windows_10_2004
Version / affected range: * · before (exclusive) 10.0.19041.1237
cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:* - microsoft / windows_10_20h2
Version / affected range: * · before (exclusive) 10.0.19042.1237
cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:* - microsoft / windows_10_21h1
Version / affected range: * · before (exclusive) 10.0.19043.1237
cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:* - microsoft / windows_7
Version / affected range: -
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* - microsoft / windows_8.1
Version / affected range: -
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* - microsoft / windows_rt_8.1
Version / affected range: -
cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* - microsoft / windows_server_2004
Version / affected range: * · before (exclusive) 10.0.19041.1237
cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:* - microsoft / windows_server_2008
Version / affected range: -
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* - microsoft / windows_server_2008
Version / affected range: r2
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* - microsoft / windows_server_2012
Version / affected range: -
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* - microsoft / windows_server_2012
Version / affected range: -
cpe:2.3:o:microsoft:windows_server_2012:-:r2:*:*:*:*:*:* - microsoft / windows_server_2016
Version / affected range: * · before (exclusive) 10.0.14393.4651
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* - microsoft / windows_server_2019
Version / affected range: * · before (exclusive) 10.0.17763.2183
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* - microsoft / windows_server_2022
Version / affected range: * · before (exclusive) 10.0.20348.230
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* - microsoft / windows_server_20h2
Version / affected range: * · before (exclusive) 10.0.19042.1237
cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*
References
- secure@microsoft.com
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- CISA Advisory
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (2)
- These CVEs affect network-exposed or externally CVE-2021-40444 This zero-day vulnerability could Microsoft Digital Defense Report 2026 Highlights AI-Accelerated Attacks and Agent Security Risks
- HomeBlogThreat Advisory: Hackers Are Exploiting CVE-2021-40444 Hackers Exploit CVE-2021-40444 Through Malicious Office and RTF Files
CVE (4)
Malware (7)
People (7)
Threat Actors (2)
MITRE ATT&CK (18)
Vendors (2)
Products (14)
Tools (4)
Industries (10)
Countries (10)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.