CVE-2021-27059

What it actually does

This vulnerability is categorized as remote code execution. In the Microsoft Office context, exploitation would occur through crafted Office content that triggers unsafe processing and allows attacker-controlled code to run when a user opens or previews the malicious file. The CVSS vector indicates exploitation requires user interaction and high attacker privileges, but successful exploitation can cross a security boundary and affect confidentiality, integrity, and availability at a high level. The supplied affected-product metadata also references Debian and Ubuntu Linux kernel packages, so organizations should validate both the Office advisory context and the listed operating-system package fixed versions when determining exposure.

Why it matters to the business

Successful exploitation can allow an attacker to compromise a user workstation or affected system, steal sensitive data, install malware, disrupt operations, and use the foothold for lateral movement. This issue is listed in CISA KEV with a remediation due date of 2021-11-17 and is marked as actively exploited in the wild, so unpatched systems should be treated as a priority even though the current EPSS score is relatively low and stable.

How an attack unfolds

An attacker typically delivers a malicious Office document or link through phishing, file sharing, or another social-engineering channel. The victim is persuaded to open or preview the content in a vulnerable Office component. The crafted content triggers the flaw and causes code execution in the context of the affected application or user session. After execution, the attacker commonly launches a second-stage payload, establishes command-and-control, collects credentials or documents, and attempts privilege escalation or lateral movement. Because the input metadata also lists Linux kernel packages as affected, defenders should separately verify whether endpoint, server, container, or cloud images include the vulnerable package versions and update them where applicable.

How to fix it

Apply vendor security updates for Microsoft Office and any affected platform packages. For the supplied Linux package metadata, update to at least the listed fixed versions where applicable: Debian 11/12/13 linux 5.2.6-1; Ubuntu 16.04 LTS linux 4.2.0-16.19, linux-aws 4.4.0-1001.10, linux-azure 4.15.0-1083.93~16.04.1, linux-hwe 4.15.0-101.102~16.04.1, linux-kvm 4.4.0-1004.9, linux-raspi2 4.2.0-1013.19, linux-snapdragon 4.4.0-1020.23, linux-aws-hwe 4.15.0-1067.71~16.04.1, linux-oracle 4.15.0-1039.43~16.04.1; Ubuntu 18.04 LTS linux 4.15.0-101.102, linux-aws 4.15.0-1067.71, linux-azure-5.3 5.3.0-1007.8~18.04.1, linux-gcp-5.3 5.3.0-1008.9~18.04.1, and linux-gke-4.15 4.15.0-1059.62. Where immediate patching is not possible, reduce exposure by blocking or sandboxing untrusted Office documents, disabling unnecessary active content, using Protected View, enforcing attachment detonation, limiting Office child-process creation, and applying least privilege. For Linux kernel package remediation, reboot systems after kernel updates so the fixed kernel is actually running.

How to confirm the fix worked

Confirm Microsoft Office installations are at a vendor-supported patched build level and verify endpoint management or vulnerability-scanning data no longer reports the CVE. For Linux package exposure, verify installed package versions meet or exceed the fixed versions and confirm the running kernel after reboot using package inventory and runtime kernel checks. Validate that email, web, and endpoint controls block or detonate untrusted Office files. Attempt safe control validation by opening benign test documents in a sandbox and confirming Office child-process restrictions, macro policies, Protected View, and EDR telemetry are functioning as expected.

Typical attack path

1. Attacker prepares a malicious Office document or link designed to trigger the vulnerable code path.
2. Attacker delivers the content through phishing, compromised file sharing, email attachment, or a staged web download.
3. User opens or previews the crafted content on a vulnerable system.
4. The vulnerability is triggered and attacker-controlled code executes.
5. Attacker launches a payload or script from the Office process or affected component.
6. Attacker establishes persistence, command-and-control, credential access, or data collection.
7. Attacker uses the compromised system for lateral movement, additional exploitation, or operational disruption.

How to detect it

Hunt across endpoint, email, web proxy, DNS, firewall, and authentication logs for evidence that malicious Office content was opened and led to code execution. Key endpoint indicators include Office processes spawning command shells, scripting engines, download utilities, encoded PowerShell, rundll32/regsvr32/mshta usage, suspicious files written to temporary directories, unexpected scheduled tasks, new Run keys, and network connections shortly after document open events. Review email security logs for attachments or URLs followed by endpoint alerts. Check EDR process trees for WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, OUTLOOK.EXE, or other Office processes launching non-Office binaries. For Linux package exposure, detection of prior exploitation is less deterministic from the provided metadata; review kernel logs, audit logs, crash logs, privilege-escalation traces, unusual module loading, and suspicious processes around the time vulnerable kernels were running. Because this is a KEV-listed issue with active exploitation, include historical hunts covering the period before patch deployment.

• WINWORD.EXE spawning cmd.exe
• WINWORD.EXE spawning powershell.exe
• WINWORD.EXE spawning wscript.exe
• WINWORD.EXE spawning cscript.exe
• WINWORD.EXE spawning mshta.exe
• WINWORD.EXE spawning rundll32.exe
• WINWORD.EXE spawning regsvr32.exe
• WINWORD.EXE spawning certutil.exe
• WINWORD.EXE spawning bitsadmin.exe
• EXCEL.EXE spawning cmd.exe
• EXCEL.EXE spawning powershell.exe
• POWERPNT.EXE spawning cmd.exe
• POWERPNT.EXE spawning powershell.exe
• OUTLOOK.EXE spawning WINWORD.EXE followed by powershell.exe
• powershell.exe -EncodedCommand
• powershell.exe -enc
• cmd.exe /c powershell
• mshta.exe http
• rundll32.exe javascript:
• regsvr32.exe /s /n /u /i:http
• certutil.exe -urlcache -split -f
• bitsadmin /transfer
• %TEMP%\*.hta
• %TEMP%\*.vbs
• %TEMP%\*.ps1
• %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• HKLM\Software\Microsoft\Windows\CurrentVersion\Run
• /var/log/kern.log
• /var/log/syslog
• kernel: BUG:
• kernel: Oops
• kernel: general protection fault
• kernel: segfault
• audit: ANOM_ABEND
• insmod
• modprobe

What your security team should do

• Treat unpatched assets as high priority because the vulnerability is in CISA KEV and has documented active exploitation in the wild.
• Patch Microsoft Office and reconcile the supplied Debian/Ubuntu kernel package exposure data against asset inventory.
• Prioritize internet-facing, email-heavy, VDI, high-value user, administrator, and developer endpoints for verification and remediation.
• Hunt for suspicious Office process behavior, especially Office applications spawning shells, scripting engines, download tools, archive utilities, or LOLBins.
• Review email gateway, web proxy, EDR, and sandbox telemetry for malicious attachments or links delivered before patching.
• Enforce attack-surface reduction rules that block Office applications from creating child processes or launching executable content where operationally feasible.
• Reboot Linux systems after kernel package updates and verify the running kernel version, not only the installed package version.
• If suspicious activity is found, isolate affected endpoints, collect memory and disk artifacts, rotate exposed credentials, and scope lateral movement.