Security readout for executives and security teams
This flaw is in Microsoft's antivirus scanning engine. A maliciously crafted file could cause remote code execution when scanned, so exposure may occur through normal file handling or mail/server scanning, not only interactive user actions. The bundle lists many Windows versions, Windows Server 2016/1709, Exchange Server 2013/2016, Defender, and Forefront. No active exploitation evidence is provided. Organizations may be exposed where affected Microsoft Defender, Forefront, or Exchange Server deployments relied on the vulnerable Malware Protection Engine. The listed platform range includes Windows 7 SP1 through Windows 10 1709, Windows Server 2016/version 1709, and Exchange Server 2013/2016. High priority for legacy estate review. The bug is old, but it affects security scanning software and Exchange-related environments. The main business risk is forgotten unsupported systems, stale antivirus engines, or legacy mail infrastructure that missed vendor updates. Mitigation focus: Review the Microsoft MSRC advisory for the official remediation status.; Confirm affected Microsoft Malware Protection Engine deployments received vendor updates.; Prioritize Exchange and server-side scanning environments for remediation checks..
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-11940 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11940CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.