CVE Catalog
Actively exploited in the wild
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
Microsoft - Office · Listed in the CISA KEV since 2022-03-28. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-38646
HighCVSS 7.8KEVExploitation Probability (EPSS)
Very high risk4.40%
90th percentile - higher than 90% of all known CVEs
Summary
Remote code execution vulnerability in Microsoft Office Access Connectivity Engine. An attacker could exploit it to run malicious code on the victim's system.
Risk Assessment
Risk of remote system takeover via a specially crafted file.
Recommendation
Apply security updates for Microsoft Office.
Original NVD description (English source)
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability