Vulnerability record · CVE-2014-4123 · published 15 October 2014
CVE-2014-4123: Microsoft Internet Explorer Elevation of Privilege via Crafted Website
Microsoft · Internet Explorer
Internet Explorer 7 through 11 contains an elevation of privilege flaw reachable through a crafted website. The record gives no root cause detail beyond the CWE having insufficient information, so the exact underlying defect is unknown. It matters because the flaw was exploited in the wild and is listed in CISA KEV.
Description
Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," as exploited in the wild in October 2014, a different vulnerability than CVE-2014-4124.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityIt is a KEV-listed, in-the-wild exploited elevation of privilege with a high CVSS score, though the affected product is legacy and long out of support.
What it is
Internet Explorer 7 through 11 contains an elevation of privilege flaw reachable through a crafted website. The record gives no root cause detail beyond the CWE having insufficient information, so the exact underlying defect is unknown. It matters because the flaw was exploited in the wild and is listed in CISA KEV.
Impact
A remote attacker can gain privileges on the victim's system, potentially escaping the browser sandbox and running code at a higher integrity level. The CVSS vector rates confidentiality, integrity and availability impact as high.
Attack surface
Reached over the network via a crafted web page; the CVSS vector requires user interaction (UI:R) and no authentication (PR:N), so the victim must visit or be lured to the page. No other attack vector is described in the record.
Exploitation
CISA KEV lists it as exploited in the wild, added 2022-05-25, and the description states it was exploited in the wild in October 2014. EPSS 30-day probability is 0.47259 (98.8th percentile); no ransomware campaign use is recorded.
What to do
- Apply the Microsoft MS14-056 update referenced in the vendor advisory.
- Retire or block Internet Explorer 7 through 11, which are end-of-life and unsupported.
- Restrict browsing to a supported browser and enforce it via policy.
- Reduce reliance on IE-mode or legacy web controls that keep IE rendering engines in use.
- Apply the CISA KEV required action: apply updates per vendor instructions.
Detection
- Hunt for IE process (iexplore.exe) spawning unexpected child processes or writing to privileged locations.
- Monitor for suspicious outbound connections or payload downloads following IE page loads.
- Alert on IE usage in the environment, since the affected versions should no longer be present.
- Review endpoint telemetry for privilege escalation or token manipulation events originating from IE.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2014-4123 to the Known Exploited Vulnerabilities catalog on 25 May 2022 as "Microsoft Internet Explorer Privilege Escalation Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 15 June 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-4123 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-4123), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
