CVE-2021-27085: Microsoft Internet Explorer remote code execution flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a network-reachable remote code execution flaw with confirmed exploitation in CISA KEV, though it requires user interaction and the record lacks technical detail.

What it is

CVE-2021-27085 is a remote code execution vulnerability in Microsoft Internet Explorer. The record gives only a one-line description and no root-cause detail, so the exact flaw mechanism is not documented here. It matters because it is listed in CISA's Known Exploited Vulnerabilities catalog, meaning it has been exploited in the wild.

Impact

An attacker who successfully triggers the flaw can execute code in the context of the affected user, with high integrity impact and some confidentiality and availability impact per the CVSS vector. The scope change in the vector indicates the vulnerable component can affect resources beyond its security authority.

Attack surface

Reached over the network with no privileges required, but user interaction is required, consistent with a victim opening a crafted page or document in Internet Explorer. No affected versions or delivery mechanism are specified in the record.

Exploitation

CISA added it to the KEV catalog on 2021-11-03 with a 2021-11-17 remediation due date, confirming known exploitation. EPSS gives a 30-day probability of about 5.4 percent (92nd percentile), and no ransomware campaign use is recorded.

What to do

• Apply the Microsoft updates referenced in the MSRC advisory for CVE-2021-27085.
• Retire or disable Internet Explorer where possible and move users to a supported browser.
• Restrict or block access to untrusted web content and legacy IE rendering modes.
• Track KEV remediation deadlines and confirm patching across all endpoints.
• Limit user privileges so code execution does not run with administrative rights.

Detection

• Monitor for Internet Explorer process crashes or unexpected child processes spawned by iexplore.exe.
• Alert on outbound network connections from IE to unusual or newly seen destinations.
• Review proxy and DNS logs for known exploit delivery infrastructure tied to this CVE.
• Audit endpoints for missing patches against the MSRC advisory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.