CVE-2007-0940: Microsoft CAPICOM Certificates ActiveX control remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote code execution with no authentication required and a very high EPSS score, though no confirmed exploitation and the flaw description is thin.

What it is

An unspecified vulnerability in the CAPICOM Certificates ActiveX control (CAPICOM.dll) shipped with Microsoft CAPICOM and BizTalk Server 2004 SP1/SP2 allows remote code execution. The record gives no root-cause detail beyond the control name, so the exact flaw is unknown, but the impact is full code execution in the context of the invoking process.

Impact

An attacker who can get the vulnerable control instantiated gains arbitrary code execution with the privileges of the user or process hosting it.

Attack surface

Reached over the network through the ActiveX control, typically by a user visiting a malicious or compromised web page that instantiates CAPICOM.Certificates. No authentication is required; user interaction (loading the page) is needed, consistent with the AV:N/AC:M/Au:N vector.

Exploitation

Not listed in CISA KEV and no reference carries an exploit tag, so there is no confirmed in-the-wild exploitation in this record. EPSS is high (0.757, 99.5th percentile), indicating elevated predicted likelihood.

What to do

• Apply Microsoft security bulletin MS07-028, which addresses this CAPICOM.Certificates vulnerability.
• Remove or unregister CAPICOM.dll where the control is not required, and set the kill bit for the affected CLSID.
• Restrict ActiveX execution in browsers and enforce allow-listing of approved controls.
• Upgrade or retire BizTalk Server 2004 SP1/SP2 installations that bundle the affected control.

Detection

• Monitor for processes instantiating the CAPICOM.Certificates ActiveX control, especially from browser or Office hosts.
• Alert on unexpected child processes or script execution originating from browser processes on hosts with CAPICOM.dll present.
• Inventory endpoints for CAPICOM.dll and flag versions not covered by MS07-028.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.