CVE-2017-8657

This flaw is like a weakness in the browser’s “engine” that interprets web content. If someone tricks a user into visiting a specially prepared website, it may let the attacker run code on that computer as the same Windows user—meaning the attacker can do things the user can do, like accessing files tied to that account.

This matters if your organization runs Microsoft Edge on Microsoft Windows 10 1511, 1607, 1703, or Windows Server 2016. It’s a browser-targeted issue, so exposure is tied to using Edge to load untrusted web content. Reachability depends on whether an attacker can get a user to open a malicious page in Edge (i.e., it’s relevant through normal internet browsing).

Treat this as a priority because a public exploit is available for CVE-2017-8657. Even though it isn’t listed in CISA KEV, the combination of an available exploit and rising attention means active targeting is plausible.

1. Confirm scope

   • Identify all devices running Microsoft Edge on Microsoft Windows 10 1511, 1607, or 1703, and Windows Server 2016.
   • Also confirm whether Edge is used for day-to-day browsing by employees.

2. Check patch status

   • Use the official Microsoft advisory for CVE-2017-8657 to determine the exact security update(s) applicable to your Windows build.
   • Verify that the relevant Windows security update(s) are installed on each affected system.

3. Upgrade / remediate

   • Apply the Microsoft security update(s) referenced in the CVE-2017-8657 advisory.
   • After installation, ensure the system is fully updated so there are no remaining gaps related to the fix.

4. If patching is delayed (temporary controls)

   • Reduce exposure by limiting which users can browse to untrusted sites.
   • Encourage users to avoid opening unexpected links or attachments that could lead to malicious pages.

5. What to monitor

   • If you have endpoint logging, review browser and system logs for suspicious behavior around times users visited untrusted sites.
   • Monitor for signs of unexpected new processes started shortly after Edge usage (especially unsigned or newly installed software).

Severity is high (reported as CVSS 7.5). The weakness is CWE-119 (memory corruption), specifically described as “Scripting Engine Memory Corruption Vulnerability” in Microsoft Edge’s JavaScript rendering/handling path. The attack vector is remote via crafted web content, and the impact is code execution in the context of the current user. KEV is not listed, but a public exploit exists (weaponization present). EPSS was predicted (trend flat), but exploitation maturity is indicated by the presence of a public exploit; press attention is noted as rising.