Critical Remote Code Execution Vulnerability in Microsoft Office (CVE‑2017‑8570)
What It Is — A remote‑code‑execution (RCE) flaw in Microsoft Office that arises from improper handling of objects in memory. An attacker who can deliver a crafted document can execute arbitrary code on the victim’s machine.
Exploitability — The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) program, indicating active exploitation in the wild. CVSS v3.1 base score 9.8 (Critical).
Affected Products — Microsoft Office (all supported versions that include the vulnerable component).
Why It Matters for Trust & Control Assurance
- Demonstrates a concrete gap in the secure configuration & patch‑management control objective, a cornerstone of many frameworks (e.g., NIST CSF).
- Timely remediation provides defensible evidence of due‑diligence for auditors and continuous‑monitoring programs.
- Failure to patch can erode the trust posture that enterprise buyers now demand as part of procurement and compliance reviews.
Recommended Actions
- Deploy Microsoft’s security update that resolves CVE‑2017‑8570 across all Office installations.
- Verify patch deployment with an automated inventory or endpoint‑management tool.
- Record remediation evidence in your control‑mapping repository to support audit readiness.
Source: CISA KEV – CVE‑2017‑8570