Microsoft MSHTML Remote Code Execution Vulnerability
CVE-2021-40444 is a security vulnerability in Microsoft MSHTML, added to CISA KEV on November 3, 2021. Patch priority: Patch now. Known ransomware use: yes.
What it is
Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution.
Known to be used in ransomware campaigns. Active threat actors have chained this vulnerability into ransomware operations — treat patching as a same-week priority, not a "next maintenance window" task. The fix is the same one below; the urgency is higher.
VulnCheck tracked exploitation 57 days before CISA's KEV listing. VulnCheck's broader catalog of in-the-wild exploitation evidence picked this up before it landed on CISA's formal list. Per-CVE fact about this entry; not a population claim about lead time in general.
Who's affected
Affects anyone running Microsoft MSHTML. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
What to do
Apply updates per vendor instructions.
If you don't have someone in-house to verify the patch deployed across every endpoint — or you're not sure whether you're affected — that's exactly the kind of triage we do. Book a free 20-minute triage call.
Insurance readiness
Your insurer will ask if this is patched.
Unpatched entries on CISA's Known Exploited Vulnerabilities list are exactly what cyber-insurance carrier questionnaires probe for, and knowing which controls they check is how you keep a renewal from stalling.
Get the free carrier questionnaire →Severity
CVSS base score: 8.8 — HIGH
Weakness classification: CWE-22
Microsoft fix
- KB5005568 (Security Update)
- KB5005566 (Security Update)
- KB5005565 (Security Update)
- KB5005575 (Security Update)
- KB5005569 (Security Update)
- KB5005573 (Security Update)
- KB5005633 (Monthly Rollup)
- KB5005563 (IE Cumulative)
- KB5019958 (IE Cumulative)
- KB5005613 (Monthly Rollup)
- KB5005627 (Security Only)
- KB5005606 (Monthly Rollup)
- KB5005623 (Monthly Rollup)
Microsoft Exploitability Index (assessed at update release): Exploitation Detected
Microsoft has confirmed in-the-wild exploitation in the latest software release. This aligns with CISA's listing of this CVE.
Vendor workaround
Vendor-published workaround
Disabling the installation of all ActiveX controls in Internet Explorer mitigates this attack. This can be accomplished for all sites by configuring the Group Policy using your Local Group Policy Editor or by updating the registry. Previously-installed ActiveX controls will continue to run, but do not expose this vulnerability.
To disable ActiveX controls via Group Policy
In Group Policy settings, navigate to Computer Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page
For each zone:
- Select the zone (Internet Zone, Intranet Zone, Local Machine Zone, or Trusted Sites Zone).
- Double-click Download signed ActiveX controls and Enable the policy. Then set the option in the policy to Disable.
- Double-click Download unsigned ActiveX controls and Enable the policy. Then set the option in the policy to Disable.
We recommend applying this setting to all zones to fully protect your system.
Impact of workaround.
This sets the URLACTION_DOWNLOAD_SIGNED_ACTIVEX (0x1001) and URLACTION_DOWNLOAD_UNSIGNED_ACTIVEX (0x1004) to DISABLED (3) for all internet zones for 64-bit and 32-bit processes. New ActiveX controls will not be installed. Previously-installed ActiveX controls will continue to run.
How to undo the workaround
Set the option in the policy to the original value before the workaround was applied.
To disable ActiveX controls on an individual system via regkey:
Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
- To disable installing ActiveX controls in Internet Explorer in all zones, paste the following into a text file and save it with the .reg file extension:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
"1001"=dword:00000003
"1004"=dword:00000003
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
"1001"=dword:00000003
"1004"=dword:00000003
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
"1001"=dword:00000003
"1004"=dword:00000003
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
"1001"=dword:00000003
"1004"=dword:00000003
- Double-click the .reg file to apply it to your Policy hive.
- Reboot the system to ensure the new configuration is applied.
Impact of workaround.
This sets the URLACTION_DOWNLOAD_SIGNED_ACTIVEX (0x1001) and URLACTION_DOWNLOAD_UNSIGNED_ACTIVEX (0x1004) to DISABLED (3) for all internet zones for 64-bit and 32-bit processes. New ActiveX controls will not be installed. Previously-installed ActiveX controls will continue to run.
How to undo the workaround
Delete the registry keys that were added in implementing this workaround.
To disable preview in Windows Explorer
Disabling Shell Preview prevents a user from previewing documents in Windows Explorer. Follow these steps for each type of document you want to prevent being previewed:
- In Registry Editor, navigate to the appropriate registry key for the document type you want to prevent from being previewed. Note that if a registry key does not exist for a document type, it is already not possible to preview that document using Windows Explorer.
For Word documents:
- HKEY_CLASSES_ROOT\.docx\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}
- HKEY_CLASSES_ROOT\.doc\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}
- HKEY_CLASSES_ROOT\.docm\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}
For rich text files:
- HKEY_CLASSES_ROOT\.rtf\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}
- Export a copy of the regkey for backup.
- Double-click Name and in the Edit String dialog box, delete the Value Data.
- Click OK,
Impact of workaround
Users will not be able to preview documents with the specified extension in Windows Explorer.
How to undo the workaround
Double-click the .reg file or files that you created in Step Two of the workaround.
Vendor-published mitigation
By default, Microsoft Office opens documents from the internet in Protected View or in Application Guard for Office, both of which prevent the current attack.
- For information about Protected View, see What is Protected View?.
- For information about Application Guard for Office, see Application Guard for Office.
Customers of Microsoft Defender for Endpoint can enable attack surface reduction rule "BlockOfficeCreateProcessRule" that blocks Office apps from creating child processes. Creating malicious child processes is a common malware strategy. For more information see Use attack surface reduction rules to prevent malware infection.
A workaround reduces exposure while you patch — it is not a substitute for the update. Install the fix above as soon as you can.
CISA due date
Federal deadline: November 17, 2021. Federal agencies must complete the required action by this date. For private SMBs the deadline is advisory — but treat it as a strong recommendation, especially if you handle regulated data (HIPAA, GLBA, ABA model rules).
EPSS
EPSS score: 97.5% — higher than 100% of all scored CVEs.
EPSS estimates the probability of exploitation activity in the next 30 days. Every entry on this site is already confirmed exploited, so read it as relative urgency among the things you still have open, not as permission to wait.
Other exploited Microsoft MSHTML entries
More CISA KEV entries for Microsoft MSHTML. Same product line, same actively-exploited status.
Source
This entry comes from CISA's Known Exploited Vulnerabilities catalog, public US-Government data we pull daily. The plain-language framing and the what-to-do guidance above are ours. View the original entry on cisa.gov.