Remote Code Execution in Microsoft Internet Explorer (CVE-2017-0222) Threatens Enterprise Browsers
What It Is – A remote code execution (RCE) flaw in Microsoft Internet Explorer allows an attacker to execute arbitrary code by exploiting the browser’s improper handling of memory objects.
Exploitability – The vulnerability is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. CVSS v3.1 base score: 7.8 (High).
Affected Products – Microsoft Internet Explorer (all supported versions prior to the security update released in 2017).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous endpoint‑level patch management and evidence collection to satisfy control objectives around vulnerability remediation.
- Provides a concrete data point for auditors to verify that organizations maintain a defensible audit trail of timely updates.
- Highlights the importance of mapping a single control (patch management) to multiple frameworks (e.g., NIST CSF, ISO 27001) via a unified trust‑center view.
Recommended Actions
- Verify that every system still running Internet Explorer is patched to the latest security update or, where feasible, disable the browser entirely.
- Deploy continuous endpoint monitoring to detect unpatched browsers and generate remediation evidence.
- Record patch‑status evidence in your Trust Center to streamline audit readiness and demonstrate control compliance.
Source: CISA KEV – CVE‑2017‑0222