CVE-2021-38646

What it actually does

CVE-2021-38646 is a remote code execution vulnerability in the Microsoft Office Access Connectivity Engine used by Microsoft Office and Microsoft 365 Apps to parse and interact with Access-compatible database content. Exploitation requires user interaction: a victim must open or otherwise cause Office to process a specially crafted file. If triggered, attacker-controlled code can execute with the privileges of the user running Office. The CVSS vector indicates low attack complexity, no prior authentication required, high confidentiality, integrity, and availability impact, but a local execution context and user action are required.

Why it matters to the business

Successful exploitation can allow an attacker to take control of a user workstation, steal data accessible to that user, deploy malware, move laterally, or use the compromised endpoint as a foothold for ransomware. This vulnerability is listed in CISA KEV, has documented active exploitation, and is marked as used in ransomware campaigns, so organizations should treat unpatched Office installations as high-priority exposure even though exploitation depends on a user opening malicious content. The CISA remediation deadline was 2022-04-18, so remaining vulnerable assets are significantly overdue for remediation.

How an attack unfolds

An attacker typically delivers a malicious Office- or Access-related file through phishing, a download link, a compromised website, or another file-sharing channel. The file is crafted to trigger the vulnerability when Microsoft Office or the Access Connectivity Engine parses database-related content. Once the victim opens the file, the vulnerable component mishandles the crafted content and allows code execution in the context of the logged-in user. The attacker may then run a payload such as a downloader, credential stealer, remote access tool, or ransomware loader. Because this vulnerability is in CISA KEV and associated with ransomware use, post-exploitation activity should be assumed possible if suspicious Office file execution occurred on an unpatched endpoint.

How to fix it

Apply the relevant Microsoft security updates for Microsoft Office, Microsoft 365 Apps, and any installed Microsoft Access Database Engine / Access Connectivity Engine components. Because no exact fixed version was provided, use Microsoft Update, Microsoft 365 Apps update channels, WSUS, Configuration Manager, Intune, or the Microsoft Update Catalog to bring Office and Access Database Engine installations to a build containing the September 2021 security fixes or later. Remove unsupported Office versions and unused Access Database Engine redistributables. As mitigations until patching is complete, restrict delivery and execution of untrusted Office database files, block or quarantine risky attachment types such as Access database files from external senders where business allows, enforce Protected View and Attack Surface Reduction rules for Office child-process creation, and ensure users do not open unexpected Office files from untrusted sources.

How to confirm the fix worked

Confirm that all Microsoft Office, Microsoft 365 Apps, and Access Database Engine installations are fully updated through Microsoft update tooling or endpoint inventory. Validate that Office builds are newer than the September 2021 security update baseline for the installed channel and architecture. Check for separately installed Microsoft Access Database Engine redistributables, including both 32-bit and 64-bit variants, because they may remain vulnerable even when core Office applications are updated. Perform vulnerability scanning or authenticated software inventory to identify Office/Access components missing the relevant security update. Test endpoint controls by verifying that Office child-process blocking, Protected View, email attachment filtering, and EDR detections trigger on simulated malicious Office behavior without relying on a live exploit.

Typical attack path

1. Attacker prepares a specially crafted Office or Access database-related file that targets the Access Connectivity Engine vulnerability.
2. Attacker delivers the file to a user via phishing email, web download, file share, chat platform, or compromised site.
3. User opens the malicious file with Microsoft Office, Microsoft 365 Apps, Access, or another Office component that invokes the Access Connectivity Engine.
4. The vulnerable parser processes the crafted content and executes attacker-controlled code under the user’s privileges.
5. Initial payload launches from an Office process and establishes persistence, downloads additional tooling, steals credentials, or contacts command-and-control infrastructure.
6. Attacker uses the compromised workstation for lateral movement, data theft, or ransomware deployment.

How to detect it

Look for evidence that a user opened a suspicious Office or Access-related file followed by unexpected process execution, network connections, or payload creation. Useful log sources include EDR process telemetry, Windows Security event logs, Sysmon logs, Microsoft Defender for Endpoint Advanced Hunting, email gateway logs, proxy/DNS logs, Office telemetry, and file creation events in user-writable directories. Prioritize process trees where MSACCESS.EXE, EXCEL.EXE, WINWORD.EXE, POWERPNT.EXE, or other Office processes spawn cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, curl.exe, or unknown executables. Review email and web download records for Access database attachments or renamed archive contents followed by endpoint execution. Because this vulnerability has been associated with ransomware campaigns, also hunt for post-exploitation indicators such as credential dumping tools, remote access tooling, abnormal SMB/RDP activity, mass file modification, backup deletion commands, and ransomware staging from the same endpoint.

• MSACCESS.EXE -> cmd.exe
• MSACCESS.EXE -> powershell.exe
• MSACCESS.EXE -> wscript.exe
• MSACCESS.EXE -> cscript.exe
• MSACCESS.EXE -> mshta.exe
• MSACCESS.EXE -> rundll32.exe
• MSACCESS.EXE -> regsvr32.exe
• EXCEL.EXE -> cmd.exe
• EXCEL.EXE -> powershell.exe
• WINWORD.EXE -> cmd.exe
• WINWORD.EXE -> powershell.exe
• .mdb
• .accdb
• .mde
• .accde
• ACEODBC.DLL
• ACEOLEDB.DLL
• AppData\Local\Temp\*.exe
• powershell.exe -enc
• powershell.exe -EncodedCommand
• cmd.exe /c
• certutil.exe -urlcache
• bitsadmin.exe /transfer
• vssadmin.exe delete shadows
• wmic.exe shadowcopy delete
• bcdedit.exe /set {default} recoveryenabled no

What your security team should do

• Immediately identify and patch all Microsoft Office, Microsoft 365 Apps, and Access Database Engine installations that have not received the September 2021 or later security updates.
• Prioritize remediation because the vulnerability is in CISA KEV, has active in-the-wild exploitation, and is associated with ransomware campaigns; the KEV due date of 2022-04-18 is long past.
• Inventory standalone Access Database Engine redistributables and legacy Office installations, not just primary Office desktop applications.
• Enable or enforce Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes, executable content, and suspicious script activity where operationally feasible.
• Block or detonate inbound Access database and unusual Office attachments from external senders, including .mdb, .accdb, .mde, .accde, and related file types, unless explicitly required.
• Hunt for Office applications spawning command shells, scripting engines, download utilities, archive tools, or unknown executables, especially around the time suspicious Office files were opened.
• Review EDR telemetry, email security logs, proxy logs, and endpoint file creation events for signs of malicious Office document delivery and payload execution.
• If exploitation is suspected, isolate affected endpoints, collect forensic artifacts, reset potentially exposed credentials, and investigate lateral movement and ransomware staging activity.