Ransomware gangs are abusing a zero

CVE-2021-38646 is a remote code execution vulnerability in the Microsoft Office Access Connectivity Engine (ACE), the database engine bundled with Office that opens and processes database files. It is triggered locally (CVSS:3.1 AV:L, user interaction required, no privileges needed) when a user is persuaded to open a specially crafted file — typically a database or Office file that invokes the ACE engine — on an affected Office installation. Successful exploitation lets an attacker execute arbitrary code in the context of the signed-in user, providing initial access that has been chained into ransomware deployments, which CISA confirms as known ransomware use. Users of Microsoft Office 2016, Office 2019, and Microsoft 365 Apps are affected according to CISA's listing. The flaw is known to be exploited in the wild — it was added to CISA's KEV on 2022-03-28 — while no public proof-of-concept is available, and EPSS assigns an 8% probability of exploitation within 30 days (94th percentile).

Do: Apply Microsoft's security updates for CVE-2021-38646 to Microsoft 365 Apps, Office 2016, and Office 2019 per vendor instructions, and verify remediated builds across your fleet, prioritizing endpoints where users open untrusted files or where Microsoft Access is installed. Until patched, caution users against opening untrusted database/Office files, since exploitation requires user interaction. There is no public PoC, but confirmed ransomware use and the CISA KEV listing make this a priority patch within KEV remediation timelines.

CVE-2021-42258 is an unauthenticated SQL injection flaw (CWE-89) in BQE BillQuick Web Suite 2018 through 2021, fixed in version 22.0.9.1, that can be triggered through user-supplied input such as the txtID (username) parameter of the web interface. Because attacker-controlled input reaches the backend Microsoft SQL Server, an unauthenticated attacker with network access to the web suite can inject SQL and abuse xp_cmdshell to execute arbitrary code on the database server under the MSSQLSERVER$ account. This yields full unauthenticated remote code execution, and in observed intrusions it was used to deploy ransomware. Any organization running an affected BillQuick Web Suite release is affected, particularly those exposing the billing portal directly to the internet. The flaw is actively exploited in the wild (added to CISA KEV on 2021-11-03 with known ransomware use) and carries a high EPSS score of 74.4%, making urgent patching advisable.

Do: Upgrade BillQuick Web Suite to version 22.0.9.1 or later per BQE's instructions, as required by the CISA KEV entry. Until patched, restrict internet-facing access to the Web Suite server and review logs for SQL injection attempts against the username (txtID) parameter, unexpected xp_cmdshell usage, or commands running as MSSQLSERVER$; the referenced Huntress advisory includes indicators of compromise for the October 2021 ransomware campaign.