Actively exploited in the wild

Microsoft Windows Scripting Languages Remote Code Execution Vulnerability

Microsoft - Windows · Listed in the CISA KEV since 2022-11-08. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2022-41128

HighCVSS 8.8KEV

Published: 09/11/2022(UTC)Updated: 10/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

24.62%

98th percentile - higher than 98% of all known CVEs

A remote code execution vulnerability in Windows Scripting Languages.

An attacker could exploit this to execute code remotely on the victim's system, potentially leading to full system compromise.

Apply the security update released by Microsoft.

Original NVD description (English source)

Windows Scripting Languages Remote Code Execution Vulnerability