CVE-2021-27085: Internet Explorer Remote Code Execution Vulnerability
CVE-2021-27085 is a remote code execution vulnerability in Internet Explorer, rated Important by Microsoft, with a CVSS 3.1 base score of 8.8 (High). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft reports that it has been exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on 3 November 2021, with a remediation deadline of 17 November 2021 for US federal agencies. The EPSS model estimates a 5.45% probability of exploitation activity in the next 30 days, higher than 93% of all scored vulnerabilities. Microsoft released the fix on 9 March 2021 in the March 2021 Patch Tuesday, delivered through 4 security updates (KB5000809, KB5000822, KB5000808, KB5000802). It affects 15 products in 1 product family (Browser).
Key facts
- CVE ID
- CVE-2021-27085
- Severity
- High CVSS 8.8
- Microsoft severity
- Important
- Impact
- Remote Code Execution
- Exploited in the wild
- Yes
- Publicly disclosed
- No
- Exploitation likelihood
- Detected
- EPSS
- 5.45% (percentile 93%)
- CISA KEV
- Listed , due
- Released
- Last updated
- Patch Tuesday
- March 2021 Patch Tuesday
- Product families
- Browser
CVSS score and vector
Microsoft scores CVE-2021-27085 at 8.8 (temporal 7.9) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L/E:P/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Changed |
| Confidentiality impact | Low |
| Integrity impact | High |
| Availability impact | Low |
| Exploit code maturity | Proof of concept |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Affected products (15)
Browser
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Internet Explorer 11 on Windows 10 Version 1803 for 32-bit Systems | KB5000809 | Security Update | 10.0.17134.2087 | Yes |
| Internet Explorer 11 on Windows 10 Version 1803 for x64-based Systems | KB5000809 | Security Update | 10.0.17134.2087 | Yes |
| Internet Explorer 11 on Windows 10 Version 1803 for ARM64-based Systems | KB5000809 | Security Update | 10.0.17134.2087 | Yes |
| Internet Explorer 11 on Windows 10 Version 1809 for 32-bit Systems | KB5000822 | Security Update | 10.0.17763.1817 | Yes |
| Internet Explorer 11 on Windows 10 Version 1809 for x64-based Systems | KB5000822 | Security Update | 10.0.17763.1817 | Yes |
| Internet Explorer 11 on Windows 10 Version 1809 for ARM64-based Systems | KB5000822 | Security Update | 10.0.17763.1817 | Yes |
| Internet Explorer 11 on Windows Server 2019 | KB5000822 | Security Update | 10.0.17763.1817 | Yes |
| Internet Explorer 11 on Windows 10 Version 1909 for 32-bit Systems | KB5000808 | Security Update | 10.0.18363.1440 | Yes |
| Internet Explorer 11 on Windows 10 Version 1909 for x64-based Systems | KB5000808 | Security Update | 10.0.18363.1440 | Yes |
| Internet Explorer 11 on Windows 10 Version 1909 for ARM64-based Systems | KB5000808 | Security Update | 10.0.18363.1440 | Yes |
| Internet Explorer 11 on Windows 10 Version 2004 for 32-bit Systems | KB5000802 | Security Update | 10.0.19043.867 | Yes |
| Internet Explorer 11 on Windows 10 Version 2004 for ARM64-based Systems | KB5000802 | Security Update | 10.0.19043.867 | Yes |
| Internet Explorer 11 on Windows 10 Version 2004 for x64-based Systems | KB5000802 | Security Update | 10.0.19043.867 | Yes |
| Internet Explorer 11 on Windows 10 Version 20H2 for 32-bit Systems | KB5000802 | Security Update | 10.0.19043.867 | Yes |
| Internet Explorer 11 on Windows 10 Version 20H2 for ARM64-based Systems | KB5000802 | Security Update | 10.0.19043.867 | Yes |
Security updates (4)
Exploitation and detection
CISA Known Exploited Vulnerabilities
- Date added
- Federal due date
- Ransomware use
- Unknown
- Required action
- Apply updates per vendor instructions.
VulnCheck KEV
- Date added
- Ransomware use
- Unknown
- Independent sources
- 1
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 8.8 (HIGH)
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| internet explorer 11 | all listed versions |
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27085 (Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27085 (Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27085 (US Government Resource)
Acknowledgments
- Chi-Yu You and Dhanesh Kizhakkinan of FireEye Inc.
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 1.1 | Added an acknowledgement and changed the Exploited flag to Yes. This is an informational update only. |