CVEs / CVE-2021-38646
CVE-2021-38646: Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
- Known exploited in the CISA KEV catalog since 28 Mar 2022
- medium 6.8 CVSS 2.0 (NVD)
- EPSS 7.98% chance of exploitation in the next 30 days, higher than 94% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2021-38646
Summary
Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.
Description
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Microsoft 365 Apps for Enterprise | from 16.0.1, before https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| Microsoft Microsoft Office 2013 Service Pack 1 | from 15.0.0, before 5381.1000 | 5381.1000 |
| Microsoft Microsoft Office 2016 | from 16.0.0, before 5215.1000 | 5215.1000 |
| Microsoft Microsoft Office 2019 | from 19.0.0, before https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
Exploitation
| In CISA KEV since | 28 Mar 2022 |
|---|---|
| Due date for US federal agencies | 18 Apr 2022 |
| Used in ransomware campaigns | Known |
| Required action | Apply updates per vendor instructions. |
Severity
| CVSS 2.0 | 6.8 mediumAV:N/AC:M/Au:N/C:P/I:P/A:PScored by NVD |
|---|
References
- CVE-2021-38646 on NVD
- CVE-2021-38646 in the CISA KEV catalog
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38646 Patch, Vendor Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38646 Patch, Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38646 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.