CVE-2021-1647VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2021-1647: Microsoft Defender Remote Code Execution Vulnerability

Affects Microsoft DefenderSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 11/17/2021
EPSS: 39.7% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-1647 (opens in a new tab)

Description

CVE-2021-1647 is a high-severity vulnerability in Microsoft Defender that allows remote code execution. The vulnerability details are unspecified, but it has been exploited in the wild. No specific affected versions or patch information are provided.

Summary

Microsoft Defender contains an unspecified remote code execution vulnerability identified as CVE-2021-1647. This vulnerability has been confirmed to be exploited in the wild. The exact technical details and affected versions are not disclosed in the provided data. No patch or remediation information is available from the input.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code remotely on affected systems running Microsoft Defender. This can lead to full system compromise depending on the privileges of the Defender process. The vulnerability is actively exploited in the wild, indicating a real and present threat to affected users.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes or mitigations are published by Microsoft, users should monitor vendor communications closely and apply updates promptly once available.

CVE-2021-1647: Microsoft Defender Remote Code Execution Vulnerability

What to do

Description

Summary

Impact

Mitigation

Weaknesses

References

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:20:01 UTC

Weaknesses

References

Related threats