CVE-2021-40444

What it actually does

CVE-2021-40444 is a remote code execution vulnerability in Microsoft MSHTML, the browser rendering engine used by Windows and reachable through Microsoft Office document handling. A malicious Office document can cause MSHTML to load attacker-controlled web content and a crafted ActiveX control, commonly delivered through a CAB package, leading to execution of attacker-supplied code such as a Control Panel applet. Exploitation requires user interaction, typically opening or previewing a malicious Office file, but does not require prior authentication. Code executes in the context of the user who opened the document, so administrative users face greater system-level impact.

Why it matters to the business

Successful exploitation can give an attacker an initial foothold on Windows workstations or servers used for document handling, enabling malware installation, credential theft, lateral movement, data theft, and ransomware deployment. This vulnerability is in CISA KEV, has been exploited in the wild, is associated with ransomware activity, and has a very high EPSS score, making it a high-priority legacy exposure even years after publication. Organizations with broad Microsoft Office usage and older or unpatched Windows systems have elevated operational risk because exploitation is delivered through normal business workflows such as email attachments and shared documents.

How an attack unfolds

An attacker prepares a malicious Microsoft Office document that references attacker-controlled web content. When the target opens the document, Office invokes MSHTML to render the embedded or remote content. The content attempts to instantiate a malicious ActiveX control, often staged in a downloaded CAB archive with supporting script or INF content. If the system is vulnerable and protections do not block the activity, the attacker causes a payload such as a CPL file to execute through normal Windows components. The initial payload then commonly downloads additional malware, establishes persistence, steals credentials, performs reconnaissance, and may enable ransomware operators to move laterally and encrypt systems. Known exploitation has been targeted and in the wild, so detections should focus on malicious document delivery, Office-to-web activity, ActiveX/CAB handling, and suspicious CPL execution.

How to fix it

Install the Microsoft security updates released on September 14, 2021 or later for all affected Windows versions, including supported Windows client and server releases. Systems that cannot be patched immediately should disable ActiveX control installation and execution through Group Policy or registry-based Internet Zone settings, restrict Office from creating child processes where operationally feasible, block Office documents from the internet using Protected View and Attack Surface Reduction rules, and disable Office preview handlers for untrusted files. Ensure Microsoft Defender Antivirus signatures are updated to detection build 1.349.22.0 or newer, or equivalent protections are deployed in non-Defender environments. Because this vulnerability is in CISA KEV and associated with ransomware activity, remediation should be treated as urgent for any remaining unpatched or unsupported Windows systems.

How to confirm the fix worked

Confirm that all Windows endpoints and servers have the applicable September 2021 or later cumulative security updates installed. Verify that endpoint protection signatures are current and that Microsoft Defender or EDR policies are actively enforcing Office and script abuse protections. Validate that Office documents from the internet open in Protected View and that Office child-process creation is blocked or monitored. Test exposure by checking representative systems for missing 2021-09 or later Windows security updates, not by opening public exploit documents. Review vulnerability scanner results for CVE-2021-40444 and confirm there are no affected Windows 7, Windows 8.1, Windows 10, Windows Server 2008/2012/2016/2019/2022, or unsupported systems missing applicable updates or compensating controls.

Typical attack path

1. Attacker sends or hosts a specially crafted Microsoft Office document.
2. User opens or previews the malicious document.
3. Office invokes the MSHTML rendering engine to process attacker-controlled content.
4. MSHTML loads remote HTML/script and attempts to install or instantiate a malicious ActiveX control.
5. A staged CAB/INF/CPL payload is written to disk or cache locations.
6. Windows utilities such as control.exe or rundll32.exe are abused to execute the malicious CPL or follow-on payload.
7. Malware establishes command and control, downloads additional tools, steals credentials, or performs discovery.
8. Attacker uses the compromised endpoint for lateral movement, data theft, or ransomware deployment.

How to detect it

Review endpoint, email, proxy, DNS, and EDR telemetry for suspicious Office document activity around user-opened attachments or downloaded files. Key sources include Windows Security process creation logs Event ID 4688, Sysmon Event IDs 1, 3, 11, 15, and 22, Microsoft Defender for Endpoint alerts, Microsoft Defender Antivirus detections, Office telemetry, email gateway attachment logs, web proxy logs, and DNS logs. Look for Office applications spawning control.exe, rundll32.exe, regsvr32.exe, mshta.exe, powershell.exe, cmd.exe, wscript.exe, or cscript.exe; Office processes making outbound connections to unfamiliar domains; CAB, INF, DLL, EXE, or CPL files written under user temp, Office cache, browser cache, or INetCache paths; and command lines referencing Control_RunDLL or CPL files. In Microsoft Defender for Endpoint, specifically search for the alert “Suspicious Cpl File Execution”. Forensic review should include recently opened Office documents, extracted OOXML relationships referencing external HTTP/HTTPS URLs, cached web content, downloaded CAB archives, prefetch files for control.exe/rundll32.exe/Office applications, Amcache/Shimcache entries, SRUM network activity, and persistence mechanisms created shortly after document execution.

• Suspicious Cpl File Execution
• Control_RunDLL
• control.exe
• rundll32.exe
• mshtml.dll
• .cpl
• .cab
• .inf
• WINWORD.EXE
• EXCEL.EXE
• POWERPNT.EXE
• MSACCESS.EXE
• OUTLOOK.EXE
• WINWORD.EXE -> control.exe
• WINWORD.EXE -> rundll32.exe
• EXCEL.EXE -> control.exe
• POWERPNT.EXE -> control.exe
• AppData\Local\Temp\*.cpl
• AppData\Local\Microsoft\Windows\INetCache\*.cpl
• AppData\Local\Microsoft\Windows\INetCache\*.cab
• Content.Word
• ActiveXObject
• CodeBase
• HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1001
• HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1001
• HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1001
• HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1001
• HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1001

What your security team should do

• Prioritize patch verification across all Windows workstations and servers because this vulnerability is KEV-listed, actively exploited, and associated with ransomware campaigns.
• Hunt for historical exploitation using Office process creation, suspicious CPL execution, downloaded CAB files, and Office-initiated outbound web connections.
• Enable or enforce Microsoft Defender Antivirus build 1.349.22.0 or newer and monitor for the alert name “Suspicious Cpl File Execution”.
• Apply Microsoft Office Attack Surface Reduction rules, especially blocking Office applications from creating child processes and blocking executable content from email or webmail.
• Restrict or disable ActiveX installation and execution for Internet and Restricted Sites zones where legacy business requirements allow.
• Block or heavily inspect inbound Office documents from external senders, especially documents containing external relationships, remote templates, OLE objects, or embedded web content.
• Isolate and investigate any endpoint where Office spawned control.exe, rundll32.exe, regsvr32.exe, mshta.exe, powershell.exe, cmd.exe, wscript.exe, or cscript.exe after opening a document.
• Remove or replace unsupported Windows versions that cannot receive security updates.