CVE-2021-38646

Published: Sep 15, 2021Modified: Aug 10, 2026CISA KEV

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD (Secondary)

Description

Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

Affected (6)

Products: Microsoft: 365 Apps, Office, Office 2016, Office 2019

4 products

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Microsoft 365 Apps	All versions
Microsoft Office	Version 2013 sp1
Microsoft Office	Version 2013 sp1
Microsoft Office 2016	All versions
Microsoft Office 2016	All versions
Microsoft Office 2019	All versions

References (3)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38646

Source: secure@microsoft.com

PatchVendor Advisory

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38646

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38646

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.