CVE-2021-40444
Path Traversal in Microsoft Windows Server 2008 r2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:LSummary
CVE-2021-40444 is a high-severity Path Traversal (CWE-22) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2021-40444 is a remote code execution vulnerability in the MSHTML browser rendering engine component of Microsoft Windows. It is triggered when a Microsoft Office document hosts a malicious ActiveX control, allowing an attacker to execute arbitrary code on the target system. The flaw received a CVSS v3.1 score of 8.8 and is associated with CWE-22.
An attacker can exploit the issue by crafting a specially formed Office document and convincing a user to open it, resulting in code execution in the context of the current user. Targeted attacks leveraging this vector were observed in the wild prior to patch availability, with lower-privileged accounts experiencing reduced impact.
Microsoft released security updates on 14 September 2021 to address the vulnerability and recommends immediate installation. Microsoft Defender Antivirus (build 1.349.22.0 or newer) and Microsoft Defender for Endpoint provide detection, surfacing alerts such as “Suspicious Cpl File Execution”; customers using automatic updates receive protection without further action.
Public proof-of-concept material and technical overviews have appeared on sites such as PacketStorm, confirming active researcher interest following disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-27621
Vulnerability Data
Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An attacker could craft a malicious…
more
ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Microsoft Defender Antivirus and Microsoft Defender for Endpoint both provide detection and protections for the known vulnerability. Customers should keep antimalware products up to date. Customers who utilize automatic updates do not need to take additional action. Enterprise customers who manage updates should select the detection build 1.349.22.0 or newer and deploy it across their environments. Microsoft Defender for Endpoint alerts will be displayed as: “Suspicious Cpl File Execution”. Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs. Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability. UPDATE September 14, 2021: Microsoft has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. Please see the FAQ for important information about which updates are applicable to your system.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches path traversal via static/dynamic analysis.
Secure SDLC mandates input validation and path sanitization that directly prevent path traversal.
Application security requirements include rules for safe file handling and canonicalization.
Secure architecture principles require least-privilege file access and directory isolation.
Secure coding standards explicitly forbid unsafe path construction and mandate safe APIs.
Information access restriction limits which files an application may read or write.