High‑Severity Remote Code Execution in Microsoft Internet Explorer (CVE‑2020‑0968) Threatens Client Browsers
What It Is — Microsoft Internet Explorer’s scripting engine mishandles objects in memory, creating a memory‑corruption condition that can be leveraged for remote code execution. The flaw is tracked as CVE‑2020‑0968 and carries a CVSS v3.1 base score of 8.8 (High).
Exploitability — The vulnerability is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. No public proof‑of‑concept is required; attackers can trigger the bug via a crafted web page.
Affected Products — All supported releases of Microsoft Internet Explorer 11 on Windows 7, 8.1, and 10.
Why It Matters for Trust & Control Assurance
- Tests the vulnerability‑remediation control objective – timely patching and evidence of remediation are core to a defensible audit trail.
- Demonstrates the need for continuous monitoring of patch status across the enterprise to prove due‑diligence to auditors and partners.
- Highlights the importance of configuration hygiene (e.g., disabling legacy browsers) as part of a broader control‑assurance posture.
Recommended Actions
- Inventory all endpoints running Internet Explorer and confirm they have received the security update released in March 2020.
- If IE is not required, disable or remove the browser to eliminate the attack surface.
- Update your vulnerability‑management dashboard with remediation evidence (patch dates, asset IDs) to support audit readiness.
- Incorporate the remediation status into continuous control‑mapping reports for any framework you reference.
Source: CISA KEV – CVE‑2020‑0968