CVE-2021-27059: Microsoft Office remote code execution flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityConfirmed exploitation via CISA KEV and a high CVSS score of 7.6 outweigh the high attack complexity and privilege requirements.

What it is

CVE-2021-27059 is a remote code execution vulnerability in Microsoft Office and Office 2016. The record gives only the generic title and no root-cause detail, so the exact flaw mechanism is unknown. It matters because it is listed in CISA's Known Exploited Vulnerabilities catalog, meaning it has been exploited in the wild.

Impact

An attacker who successfully exploits the flaw can execute code in the context of the affected Office process, potentially leading to full compromise of the user's system. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

The vector is network-reachable (AV:N) but requires high attack complexity, high privileges, and user interaction, so an attacker likely needs a privileged position plus a victim opening a crafted document or similar action. No specific delivery mechanism is described in the record.

Exploitation

CVE-2021-27059 is in CISA's KEV catalog with a 2021-11-17 remediation due date, confirming known exploitation. EPSS 30-day probability is about 6.1 percent (93rd percentile), and no ransomware campaign use is documented.

What to do

• Apply the Microsoft updates referenced in the MSRC advisory for CVE-2021-27059.
• Prioritize patching per CISA KEV remediation guidance given confirmed exploitation.
• Restrict or block untrusted Office documents and macros via email and web gateways.
• Enforce least privilege so users do not operate with unnecessary high privileges.
• Enable attack surface reduction rules and Protected View for Office content.

Detection

• Monitor for Office processes spawning unexpected child processes such as cmd.exe, powershell.exe, or wscript.exe.
• Alert on suspicious file writes or network connections originating from WINWORD.EXE, EXCEL.EXE, or other Office binaries.
• Review endpoint logs for Office documents opened from email attachments, downloads, or temp directories.
• Hunt for known exploitation artifacts using vendor and CISA KEV guidance where available.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.