Remote Code Execution in Microsoft Internet Explorer Scripting Engine (CVE‑2018‑8373)
What It Is – A remote code execution (RCE) flaw exists in the Internet Explorer (IE) scripting engine. The vulnerability (CVE‑2018‑8373) allows an attacker to corrupt memory objects and execute arbitrary code on a victim’s machine.
Exploitability – The vulnerability is exploitable over the network via malicious web content. Public proof‑of‑concept code has been released, and the CVSS v3.1 base score is 7.8 (High).
Affected Products – Microsoft Internet Explorer (all supported versions at the time of the advisory).
Why It Matters for Trust & Control Assurance
- Vulnerability Management – Demonstrates the need for a documented, repeatable process to inventory, assess, and remediate software flaws.
- Patch & Configuration Evidence – Continuous monitoring of patch status provides defensible audit evidence that the organization is exercising due diligence.
- Supply‑Chain Assurance – Even legacy browsers can become attack vectors; proving they are either fully patched or disabled satisfies a control objective common to SOC 2, ISO 27001, NIST CSF, and others.
Recommended Actions
- Verify that all IE installations are updated to the latest security patch released by Microsoft (or retire IE where possible).
- Update your asset inventory to flag browsers lacking the fix and generate remediation tickets.
- Enable continuous monitoring of patch compliance and retain evidence in a trusted repository for audit readiness.
- Review web‑gateway policies to block legacy IE traffic from untrusted sites.
Source: CISA KEV – CVE‑2018‑8373