CVE-2021-40444

Microsoft MSHTML Remote Code Execution Vulnerability

Exploited in the wild. In CISA KEV since 2021‑11‑03. A vendor fix is available.

CVSS 3.18.8High EPSS percentile99th97% chance in 30 days CISA KEVListedsince 2021-11-03, due 2021-11-17
Public exploit: 3 sources FixVendor fixNo build named by the sources

Published 2021-09-15Updated 2026-08-10Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Microsoft Defender Antivirus and Microsoft Defender for Endpoint both provide detection and protections for the known vulnerability. Customers should keep antimalware products up to date. Customers who utilize automatic updates do not need to take additional action. Enterprise customers who manage updates should select the detection build 1.349.22.0 or newer and deploy it across their environments. Microsoft Defender for Endpoint alerts will be displayed as: “Suspicious Cpl File Execution”. Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs. Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability. UPDATE September 14, 2021: Microsoft has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. Please see the FAQ for important information about which updates are applicable to your system.

In plain language

Written by AI from the record

CVE-2021-40444 is a Windows bug that can let attackers run code after tricking a person into opening a malicious Office document; typical small businesses using affected Windows versions should treat this as urgent and install the Windows updates.

CVE-2021-40444 is a Microsoft MSHTML remote code execution vulnerability that can be triggered through specially crafted Office documents hosting the MSHTML rendering engine, and it has confirmed real-world exploitation per the CISA KEV list used in ransomware campaigns.

If you're affected

Full device takeover
Ransomware infection risk
Business operations disruption
Sensitive data theft risk

What is it

This is a Windows weakness inside the browser-rendering component (MSHTML). If a user is tricked into opening a specially made Office document, that document can try to make Windows run attacker code. Think of it like a “booby-trapped” document that can trigger an automatic compromise when opened—especially dangerous if the user’s account has higher privileges.

Who is affected

This matters if your small business runs Microsoft Windows on any of the affected versions: Windows 10, Windows 7, Windows 8.1, or the listed Windows Server editions. If you receive and open emails or Office documents from the outside, you are a typical target for this kind of trick.

How urgent is it

This is RED because it is on the CISA KEV list and was used in ransomware campaigns, meaning attackers are actively using it. Attackers can take advantage after users open malicious Office documents that trigger the MSHTML weakness.

What to do — in detail

Confirm exposure (fast inventory):
- Identify which devices run Windows 10, Windows 7, Windows 8.1, and the listed Windows Server editions.
- Pay special attention to PCs and servers that interact with email/web and open Microsoft Office documents.
Determine the right fixed version for each OS:
- Windows 10: ensure you are on one of the fixed builds provided by Microsoft for your branch.
  - Fixed versions listed: 10.0.10240.19060; 10.0.14393.4651; 10.0.17763.2183; 10.0.18363.1801; 10.0.19041.1237; 10.0.19042.1237; 10.0.19043.1237.
- Windows 7 / Windows Server 2008 R2: fixed in 6.1.7601.25712.
- Windows Server 2008: fixed in 6.0.6003.21218.
- Windows 8.1: fixed in 6.3.9600.20120.
- Windows Server 2012: fixed in 6.2.9200.23462.
Patch plan:
- Follow Microsoft’s vendor update instructions for CVE-2021-40444 (MSRC update guide).
- Install updates immediately on internet-facing and high-value systems first, then work through the rest.
- If you rely on managed enterprise updates, ensure the deployment includes the relevant update for your Windows branch.
Defender protections (supporting controls, not a replacement for patching):
- Ensure Microsoft Defender Antivirus and Microsoft Defender for Endpoint are enabled and updated.
- If managing endpoints centrally, deploy Microsoft Defender for Endpoint detection build 1.349.22.0 or newer across your environment.
- Watch for the Defender detection label “Suspicious Cpl File Execution”.
Temporary workaround considerations:
- If you cannot patch immediately, follow Microsoft’s linked security guidance/workarounds from the MSRC advisory for CVE-2021-40444 while you schedule updates. (Use only the vendor guidance provided for this CVE.)
Timeframe reminder:
- CISA KEV remediation due date for this issue was 2021-11-17.
After patching (what to monitor):
- Confirm no remaining devices are on vulnerable builds.
- Review Defender alerts for “Suspicious Cpl File Execution” and investigate any hits (including the source email/document).

Technical context

Severity and reachability: The vulnerability is a remote code execution flaw in Microsoft MSHTML (CWE-22) affecting multiple Windows versions. It is triggered when a user opens specially crafted Microsoft Office documents that host/abuse the browser rendering engine.

Exploitation status: Confirmed real-world exploitation is reflected by CISA KEV listing (added 2021-11-03) and its association with ransomware campaigns. Public exploits are available (weaponized), indicating mature attacker capability.

Mitigations and detection: Microsoft states Microsoft Defender Antivirus and Microsoft Defender for Endpoint provide detection and protections for the known vulnerability; Defender for Endpoint alerts appear as “Suspicious Cpl File Execution”. For enterprise environments, Microsoft advises ensuring detection build 1.349.22.0 or newer.

KEV meaning here: KEV (CISA Known Exploited Vulnerabilities) indicates the vulnerability is known to be exploited in the wild, which is why this issue is treated as urgent even for organizations that are not security teams.

Fix: Microsoft provides fixed builds per OS branch (listed in the PATCH findings). Apply the correct fixed version for each Windows version you run.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Listed as exploited in the wild since 2021-11-03.

US federal agencies must remediate by 2021-11-17.

Known use in ransomware campaigns.

Apply updates per vendor instructions.

Public exploits

3 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

97% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 127 days before any public exploit.

2026-08-10Patch availablepatch available, workaround available, workaround available, record updated, record updated
2026-06-25OpenVAS check added
2026-03-06Public exploit / PoCsource: packetstorm
2025-10-30Patch availableworkaround available, record updated
2021-11-03Added to CISA KEVransomware campaign
2021-09-15Publishedweakness classified, att&ck mapped

Affected products

Microsoft Corpcommercial · USaka Microsoft, microsoft corporation

And 61 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability LowReduced performance or intermittent disruption of service