CVE-2021-42298

—

CVSS 3.1

7.8 high

EPSS

6%p93

Published

Nov 10, 2021 (Nov 10, 2021)

Modified

Aug 19, 2026

Description

Microsoft Defender Remote Code Execution Vulnerability

Vendors: microsoft
Products: malware protection engine
Weakness: CWE-94
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (5.8%)

In the news6 stories

Google accuses Spanish spyware company of ties to zero

The RecordJan 9, 00:00 UTC · Jan 9, 2023Malware in the wildCVE-2021-42298 CVE-2022-26485

60

Google Accuses Spanish Spyware Vendor of Exploiting Chrome, Firefox, & Windows Zero

The Hacker NewsDec 3, 04:17 UTC · Dec 3, 2022Malware CVE-2021-42298 CVE-2022-26485

60

Google links three exploitation frameworks to Spanish commercial spyware vendor Variston

Security AffairsNov 30, 21:35 UTC · Nov 30, 2022Malware CVE-2021-42298 CVE-2022-26485

60

Microsoft Issues Patches for Actively Exploited Excel, Exchange Server 0

The Hacker NewsNov 10, 06:24 UTC · Nov 10, 2021Vulnerability in the wildCVE-2021-42321 CVE-2021-42292 CVE-2021-43208+16 CVEs

60

Microsoft Patch Tuesday for Nov. 2021 — Snort rules and prominent vulnerabilities

Cisco TalosNov 9, 20:26 UTC · Nov 9, 2021Vulnerability in the wildCVE-2021-42292 CVE-2021-38666 CVE-2021-42298+1 CVEs

60

Microsoft patches actively exploited Exchange, Excel zero-days (CVE-2021-42321, CVE-2021-42292)

Help Net SecurityNov 9, 00:00 UTC · Nov 9, 2021Exploit / PoC in the wildCVE-2021-42321 CVE-2021-42292 CVE-2021-38666+2 CVEs

60