{"id":"CVE-2021-42292","kind":"vulnerability","aliases":["CVE-2021-42292"],"related":[],"title":"Microsoft Office: Microsoft Excel Security Feature Bypass","description":"A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution.\n\nCISA required action: Apply updates per vendor instructions.","summary":"A security feature bypass in Microsoft Excel lets a local user get arbitrary code execution. The sources say it is actively exploited in the wild, with CISA listing it in KEV.","severity":"high","cvss":7.8,"epss":0.43005,"exploited":true,"exploited_at":"2021-11-17T00:00:00+00:00","products":[{"name":"Microsoft Office","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["excel","exploited","infrastructure","microsoft-office","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply Microsoft's updates for Office per vendor instructions, as CISA requires; the sources do not name the patched build.","status":"open","published_at":"2021-11-10T01:19:47+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:32:02+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:32:02Z","model":"claude-haiku-5-5","output":{"fix":"Apply Microsoft's updates for Office per vendor instructions, as CISA requires; the sources do not name the patched build.","reach":"local","impact":"high","summary":"A security feature bypass in Microsoft Excel lets a local user get arbitrary code execution. The sources say it is actively exploited in the wild, with CISA listing it in KEV.","category":"infrastructure","who_cares":["microsoft-office","excel","windows"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on a local user's machine via a crafted workbook","analyst_note":"Find the patched Office build numbers and the exploit delivery details (malicious file, user open) in Microsoft's CVE-2021-42292 advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000449,"input_tokens":2810,"output_tokens":335,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the patched Office build numbers and the exploit delivery details (malicious file, user open) in Microsoft's CVE-2021-42292 advisory.","search":"'-2021':9A,12A '-42292':10A,13A 'action':74C 'activ':43B 'allow':63C 'appli':75C 'arbitrari':35B,69C 'bypass':7A,26B,57C 'cisa':49B,72C 'code':36B,70C 'cve':8A,11A 'excel':4A,16B,29B,61C 'execut':37B,71C 'exploit':17B,44B 'featur':6A,25B,56C 'get':34B 'infrastructur':18B 'instruct':79C 'kev':53B 'let':30B 'list':50B 'local':32B,65C 'microsoft':1A,3A,14A,20B,28B,60C 'microsoft-offic':19B 'offic':2A,21B 'office':15A 'per':77C 'perform':68C 'requir':73C 'say':40B 'secur':5A,24B,55C 'sourc':39B 'updat':76C 'user':33B,66C 'vendor':78C 'vulner':58C 'wild':47B 'window':22B 'would':62C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-11-10T01:19:47+00:00","kev":{"dateAdded":"2021-11-17","dueDate":"2021-12-01","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-42292","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-42292","severity":null,"published_at":"2021-11-17T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T11:39:17+00:00","note":null},{"source":"epss","external_id":"CVE-2021-42292","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-42292","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-42292","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42292","severity":null,"published_at":"2021-11-10T01:19:47+00:00","modified_at":"2026-08-19T19:23:04+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}