CVE-2021-27085
Microsoft Internet Explorer Remote Code Execution Vulnerability
Description
CVE-2021-27085 is a high-severity remote code execution vulnerability affecting Microsoft Internet Explorer 11. The vulnerability allows an attacker to execute arbitrary code remotely by exploiting an unspecified flaw in Internet Explorer. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With a CVSS 3.1 score of 8.8 and an EPSS score of 1.62% (81.6th percentile), this vulnerability poses a significant risk to organizations still running Internet Explorer in their environments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | internet explorer | 11 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
Weakness Type
No specific CWE has been assigned to CVE-2021-27085 in the NVD database. The vulnerability involves an unspecified flaw in Microsoft Internet Explorer that enables remote code execution, though the precise weakness category has not been formally classified.
Impact Analysis
CVE-2021-27085 carries a CVSS 3.1 score of 8.8 (HIGH), reflecting a serious security threat. The vulnerability is remotely exploitable over the network with low attack complexity, requiring no authentication, though user interaction is needed to trigger exploitation. The scope is changed, meaning successful exploitation can impact resources beyond the vulnerable Internet Explorer component itself. Integrity (High): an attacker can make significant unauthorized modifications to data and systems. Confidentiality (Low): some information disclosure is possible. Availability (Low): partial disruption of service availability may occur. Organizations relying on Internet Explorer 11 face meaningful operational and data integrity risks if this vulnerability remains unpatched.
Exploit Maturity
CVE-2021-27085 is confirmed as actively exploited through its inclusion in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2021-11-17. The EPSS score of 1.62% (81.6th percentile) indicates a notable probability of exploitation activity. No public exploit code has been identified in the available references; however, the confirmed active exploitation status means threat actors are already leveraging this vulnerability in real-world attacks. Ransomware usage is not currently associated with this vulnerability.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Install the latest security update from the Microsoft Security Response Center.
- Verify that all instances of Microsoft Internet Explorer 11 have been updated to the patched version across the organization.
- As an interim mitigation, consider migrating users from Internet Explorer to a modern, supported browser such as Microsoft Edge, which significantly reduces the attack surface.
- Implement network-level controls such as web content filtering and restricted browsing policies to limit exposure to malicious web content that could trigger exploitation.
- Monitor endpoint detection and response (EDR) systems for indicators of compromise, including unusual process spawning from Internet Explorer and unexpected network connections.
Technical Details
CVE-2021-27085 is a remote code execution vulnerability in Microsoft Internet Explorer 11. While the exact technical mechanism has not been publicly detailed, the vulnerability allows attackers to execute arbitrary code in the context of the affected browser process. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L) indicates that exploitation occurs over the network with low complexity, requires no privileges but does require user interaction such as visiting a malicious webpage. The changed scope metric indicates the vulnerability can affect components beyond Internet Explorer itself, potentially compromising the underlying operating system or other applications.
Frequently Asked Questions
Is CVE-2021-27085 being actively exploited?
Yes. CVE-2021-27085 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies were required to remediate this vulnerability by 2021-11-17. The EPSS score of 1.62% (81.6th percentile) further supports the likelihood of exploitation.
What products are affected by CVE-2021-27085?
CVE-2021-27085 affects Microsoft Internet Explorer version 11. This includes all supported Windows platforms where Internet Explorer 11 is installed and accessible to users.
How do I fix CVE-2021-27085?
Apply updates per vendor instructions by installing the latest Microsoft security update for Internet Explorer 11. Where possible, migrate users to a modern browser such as Microsoft Edge. If patching is not immediately feasible, restrict Internet Explorer usage through group policy and implement web filtering controls.
How severe is CVE-2021-27085?
CVE-2021-27085 has a CVSS 3.1 score of 8.8 (HIGH). The vulnerability allows remote code execution with changed scope, meaning exploitation can impact resources beyond the vulnerable component. Its inclusion in the CISA KEV catalog confirms that this is a serious, actively exploited threat.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.