KEVIntel
Back to KEVs
7.8
CVSS
High

CVE-2021-42292

PUBLISHED

Microsoft Excel Security Feature Bypass Vulnerability

Exploited in the wild Low complexity
Vendor
Microsoft
Product
Microsoft Office 2019, Microsoft Office 2019 for Mac, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021, Microsoft Excel 2016, Microsoft Office 2016, Microsoft Excel 2013 Service Pack 1, Microsoft Office 2013 Service Pack 1
Published
Nov 10, 2021
EPSS
—

Description

Microsoft Excel Security Feature Bypass Vulnerability

cisa microsoft

CVSS scores

CVSS v3.1 7.8 High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Exploitation status

Exploited in the wild

Recorded 2021-11-17 00:00:00 UTC · Source

SSVC decision points

Exploitation
active
Automatable
No
Technical impact
total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
CISA Nov 17, 2021
CISA Nov 17, 2021

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

corelight/CVE-2021-42292

github · Created 2021-11-09 12:14:45 UTC · 18 stars

A Zeek package to detect CVE-2021-42292, a Microsoft Excel local privilege escalation exploit.

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel

  • Added to KEVIntel