CVE-2021-42292VulnerabilityPublished 11/17/2021Updated 10/24/2026

CVE-2021-42292: Microsoft Excel Security Feature Bypass

Affects Microsoft OfficeSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/17/2021
KEV deadline: 12/01/2021
EPSS: 43.0% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-42292 (opens in a new tab)

Description

CVE-2021-42292 is a security feature bypass vulnerability in Microsoft Excel that allows a local user to execute arbitrary code. This vulnerability has been exploited in the wild. It affects Microsoft Office products, but specific affected versions are not detailed in the provided data.

Summary

This vulnerability in Microsoft Excel involves bypassing a security feature, enabling a local attacker to perform arbitrary code execution. The vulnerability is identified as CWE-357 (Improper Control of Filename for Include/Require Statement in PHP Program), indicating a flaw related to security feature bypass. Exploitation has been observed in the wild, increasing the risk to affected users. No specific affected versions or patch information is provided in the available data.

Impact

An attacker with local access can bypass security features in Microsoft Excel to execute arbitrary code, potentially leading to full system compromise depending on the privileges of the user running Excel. The vulnerability has been exploited in the wild, confirming active threat scenarios.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Microsoft security advisories for updates and apply any available patches promptly once released.

Weaknesses

CWE-357Unclassified weakness (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:42:25 UTC

Weaknesses

References

Related threats