Skip to content
VulniPulse
Sign in
Highest advisory severityHigh Exploited CISA KEV 1 vendor · 1 advisory

CVE-2021-40444

CVE-2021-40444: 1 tracked advisory record across MS Server. CISA KEV listed; exploitation observed. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

MS Server

1 advisory
  • Advisory severityHigh8.8

    High [CVE-2021-40444] Microsoft MSHTML Remote Code Execution Vulnerability

    CVE-2021-40444Source published Source updated

    Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Microsoft Defender Antivirus and Microsoft Defender for Endpoint both provide detection and protections for the known vulnerability. Customers should keep antimalware…

    Affected products in this advisory
    • Windows Server 2008 R2 Service Pack 1 (Server Core installation)
    • Windows Server 2008 Service Pack 2 (Server Core installation)
    • Windows Server 2012 (Server Core installation)
    • Windows Server 2012 R2 (Server Core installation)

    5 more entries in the full advisory.

    Source-reported affected versions
    • Windows 10 Version 1507 10.0.10240.0 before 10.0.10240.19060
    • Windows 10 Version 1607 10.0.14393.0 before 10.0.14393.4651
    • Windows 10 Version 1809 10.0.17763.0 before 10.0.17763.2183
    • Windows 10 Version 1809 10.0.0 before 10.0.17763.2183

    8 more entries in the full advisory.

    Source-reported fixed versions
    • 10.0.10240.19060
    • 10.0.14393.4651
    • 10.0.17763.2183
    • 10.0.18363.1801

    8 more entries in the full advisory.

    Mitigation guidance
    • Enterprise customers who manage updates should select the detection build 1.349.22.0 or newer and deploy it across their environments.
    • This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.
    • UPDATE September 14, 2021: Microsoft has released security updates to address this vulnerability.
    • Please see the Security Updates table for the applicable update for your system.

    1 more entries in the full advisory.

    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future MS Server CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features