Security readout for executives and security teams
Plain-English summary
This is a Microsoft Office Access Connectivity Engine remote code execution flaw. An attacker needs user interaction, but successful exploitation could let code run on an affected workstation with serious confidentiality, integrity, and availability impact. CISA lists it in KEV, so treat it as exploited and prioritize remediation.
Executive priority
Prioritize within the normal emergency patch window because KEV status indicates real-world exploitation and impact could include full workstation compromise. Focus first on internet-facing staff workflows and broad Office deployments.
Technical view
CVE-2021-38646 affects Microsoft Office 2013 SP1, Office 2016, Office 2019, and Microsoft 365 Apps for Enterprise. The CVSS 3.1 score is 7.8 with local attack vector, low complexity, no privileges, required user interaction, and high CIA impact. Microsoft indicates official remediation is available.
Likely exposure
Exposure is likely on Windows endpoints with affected Microsoft Office or Microsoft 365 Apps installations, especially where users process untrusted Office-related content. The bundle does not identify server-side exposure or specific vulnerable file types.
Exploitation context
CISA KEV inclusion supports known exploitation. The bundle does not provide campaign details, exploit volume, target sectors, or current activity level. CVSS indicates exploitation requires user interaction and no prior privileges.
Researcher notes
Evidence supports RCE risk, affected Microsoft Office product lines, official remediation availability, and KEV status. Public bundle details are limited; avoid assuming a specific exploit chain, file format, or post-exploitation behavior without additional vendor or telemetry data.
Mitigation direction
- Apply Microsoft security updates for CVE-2021-38646 using MSRC guidance.
- Prioritize systems running affected Office and Microsoft 365 Apps versions.
- Reduce exposure to untrusted Office-related content until patched.
- Use endpoint controls to limit child-process and script abuse from Office where available.
- Confirm patch status through enterprise update management reporting.
Validation and detection
- Inventory endpoints for affected Office and Microsoft 365 Apps versions.
- Verify installed updates against Microsoft guidance for CVE-2021-38646.
- Check whether any unsupported Office 2013 SP1 systems remain in use.
- Review EDR alerts for suspicious Office-originated execution activity.
- Confirm high-risk users have received the update successfully.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-38646 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38646CVE reference · x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38646CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.