CVE‑2021‑38646: Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
What It Is – Microsoft disclosed an unspecified flaw in the Access Connectivity Engine (ACE) component of Microsoft Office that can be triggered remotely to execute arbitrary code on the host system. The vulnerability is tracked as CVE‑2021‑38646 and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating a credible risk of active exploitation.
Exploitability – The CVE is rated High (CVSS v3.1 ≈ 8.8). While a public exploit code has not been released, the KEV listing signals that threat actors are likely targeting unpatched installations.
Affected Products – Microsoft Office (all supported versions that include the Access Connectivity Engine, e.g., Office 2016, 2019, Microsoft 365).
Why It Matters for Trust & Control Assurance
- Continuous monitoring of patch‑management controls is essential; evidence that the Office update addressing CVE‑2021‑38646 is applied demonstrates due‑diligence.
- Maintaining a defensible audit trail of remediation actions satisfies a core control objective that maps to multiple frameworks (e.g., vulnerability management, change control).
- Enterprise buyers increasingly demand proof that known‑exploited flaws are mitigated before contract award or renewal.
Recommended Actions
- Deploy the Microsoft Office security update that resolves CVE‑2021‑38646 across all endpoints.
- Capture and retain patch‑compliance evidence in your control repository for audit readiness.
- Enrich your vulnerability‑management dashboard with CISA KEV feeds to flag emerging exploited flaws.
- Validate that any third‑party integrations that rely on ACE are also updated.
Source: CISA KEV – CVE‑2021‑38646