Microsoft: Attackers Exploiting Windows Zero-Day Flaw

Summary: Microsoft warned that attackers are exploiting CVE-2021-40444, a previously unknown vulnerability in the MSHTML component of Internet Explorer on Windows 10 and many Windows Server versions, to seize control of PCs when users open a malicious document or visit a booby-trapped website. No official patch exists yet, though Microsoft recommends disabling the installation of all ActiveX controls in IE and is slated to release its monthly Patch Tuesday bundle on September 14.
What you should know: The vulnerable MSHTML component is also used by Microsoft Office to render web-based content, and researcher EXPMON said it reproduced the attack on the latest Office 2019 / Office 365 on Windows 10, calling the exploit perfectly reliable because it uses logical flaws.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-40444
Related: CVE-2021-40444: Microsoft MSHTML Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
Microsoft Patch Tuesday for Sept. 2021 — Snort rules and prominent vulnerabilities Cyber Risks ·
Threat Source newsletter (Sept. 16, 2021) Cyber Risks ·