Critical Remote Code Execution Vulnerability (CVE‑2021‑27085) in Microsoft Internet Explorer
What It Is — Microsoft Internet Explorer contains an unspecified flaw that permits an attacker to execute arbitrary code on a victim machine. The vulnerability is tracked as CVE‑2021‑27085 and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Exploitability — The vulnerability is rated 9.8 (Critical) on the CVSS 3.1 scale and is known to be actively exploited in the wild. Public exploits and proof‑of‑concept code have been observed.
Affected Products — Microsoft Internet Explorer (all supported versions on Windows 10, Windows 11, and legacy Windows releases).
Why It Matters for Trust & Control Assurance
- Patch Management Controls – Demonstrating timely remediation of high‑severity flaws is a core control objective that maps to multiple frameworks (e.g., NIST CSF Identify > Asset Management, ISO 27001 A.12.6).
- Evidence of Due Diligence – Maintaining auditable records of patch deployment provides defensible proof for regulators and enterprise auditors.
- Continuous Monitoring – Ongoing verification that the vulnerability is no longer present supports a trustworthy security posture demanded by modern buyers.
Recommended Actions
- Deploy Microsoft’s security update for CVE‑2021‑27085 immediately across all endpoints.
- Verify remediation via an automated vulnerability scanner or endpoint management tool.
- Capture remediation evidence (patch version, scan results) in your control‑mapping repository to satisfy audit requirements.
- Review and tighten browser usage policies; consider restricting or disabling Internet Explorer where feasible.
Source: CISA KEV – CVE‑2021‑27085