Both Microsoft and federal cybersecurity officials are urging organizations to use mitigations to combat a zero-day remote control execution (RCE) vulnerability in Windows that allows attackers to craft malicious Microsoft Office documents.
Microsoft has not revealed much about the MSHTML bug, tracked as CVE-2021-40444, beyond that it is “aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents,” according to an advisory released Tuesday.
However, it’s serious enough that the Cybersecurity and Infrastructure Security Agency (CISA) released an advisory of its own alerting users and administrators to the vulnerability and recommending that they use the mitigations and workarounds Microsoft recommends.
