CVE-2021-40444: Microsoft MSHTML remote code execution via malicious Office document

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use, has a very high EPSS score, public exploits exist, and it enables remote code execution via a common user action.

What it is

CVE-2021-40444 is a remote code execution flaw in the MSHTML browser rendering engine on Microsoft Windows. An attacker can embed a malicious ActiveX control in a crafted Microsoft Office document, and opening that document can execute code in the context of the user. Microsoft confirmed targeted attacks in the wild and released security updates on September 14, 2021.

Impact

Successful exploitation gives the attacker code execution with the privileges of the logged-on user, which can lead to full system compromise if that user has administrative rights. Microsoft notes users with fewer rights are less impacted.

Attack surface

The vector is network-reachable (AV:N) with no privileges required (PR:N) but requires user interaction (UI:R) to open the malicious Office document. No authentication is needed; the attacker must convince the victim to open the file.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a due date of 2021-11-17 and flags known ransomware campaign use. EPSS is 0.9745 (99.897th percentile), and references include public exploit write-ups, indicating active and widespread exploitation.

What to do

• Apply the Microsoft security updates released September 14, 2021 for all affected Windows versions immediately.
• Ensure Microsoft Defender Antivirus and Defender for Endpoint are updated to detection build 1.349.22.0 or newer.
• Disable or restrict ActiveX controls in Office documents and block untrusted Office file execution where feasible.
• Follow Microsoft's published mitigations and workarounds for MSHTML/Office until fully patched.
• Limit user privileges so day-to-day accounts do not run with administrative rights.

Detection

• Monitor for Microsoft Defender for Endpoint alerts named 'Suspicious Cpl File Execution'.
• Hunt for Office processes (WINWORD.EXE, EXCEL.EXE) spawning child processes such as control.exe, rundll32.exe, or other unexpected binaries.
• Look for Office documents loading remote or unusual ActiveX/HTML content, especially from email or downloads.
• Review endpoint telemetry for .cpl or DLL execution originating from Office or temporary directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.