CVE-2021-38646: Microsoft Office Access Connectivity Engine remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA's KEV catalog with known ransomware use, but exploitation requires local file delivery and user interaction, which limits mass exploitation.

What it is

The Microsoft Office Access Connectivity Engine contains a remote code execution flaw. The record gives no root-cause detail beyond the CWE being marked as insufficient information, so the exact defect is not described. It matters because Microsoft Office is widely deployed and the flaw is listed in CISA's Known Exploited Vulnerabilities catalog.

Impact

An attacker who gets a crafted file opened can execute code in the context of the current user, with high impact to confidentiality, integrity and availability. Because the vector is local with user interaction, the gain depends on the victim opening the malicious content.

Attack surface

Reached locally: the CVSS vector is AV:L with UI:R, so the attacker must deliver a file or content that the user opens, and no privileges are required (PR:N). No network-reachable service is indicated by the record.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-03-28 with a 2022-04-18 remediation due date and flags known ransomware campaign use. EPSS puts 30-day exploitation probability at about 8 percent (94th percentile), and the only references are vendor patches and the CISA catalog entry.

What to do

• Apply the Microsoft updates referenced in the MSRC advisory for the affected Office products.
• Block or restrict opening of untrusted Access and Office documents from email and downloads.
• Enforce Mark-of-the-Web and Protected View so externally sourced files cannot run code silently.
• Remove or disable the Access Connectivity Engine components on hosts that do not need Access database connectivity.
• Track KEV remediation deadlines and confirm patched status across Office 2016, Office 2019 and Microsoft 365 Apps.

Detection

• Monitor for Office processes spawning child processes such as cmd.exe, powershell.exe or script hosts.
• Alert on Access or Office documents loaded from email attachments, downloads or temporary internet paths.
• Audit hosts for missing Office security updates matching the MSRC advisory.
• Review endpoint telemetry for unusual file writes or persistence created shortly after an Office document is opened.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.