CVE-2021-38646
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
CVSS
7.8
High
EPSS
8.0%
p95
KEV
YES
Mar 28, 2022
Exploit Today
78
0-100
Published: Sep 15, 2021 · Last modified: Aug 10, 2026
8.0%EPSS · 30 days8.0%
2026-09-172026-10-15
Product
Microsoft / Office
Vulnerability
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
Added to KEV
Mar 28, 2022
Remediate by
Apr 18, 2022
Known ransomware use
Yes
Summary description
Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2021-38646
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-217157.3 HIG96.1%
KEV—79Microsoft Office Publisher Security Feature Bypass Vulnerability58dCVE-2021-422927.8 HIG98.7%
KEV—80Microsoft Excel Security Feature Bypass58dCVE-2021-270597.6 HIG93.3%
KEV—78Microsoft Office Remote Code Execution Vulnerability58dCVE-2017-11882—100.0%
KEV—80Microsoft Office Memory Corruption Vulnerability—CVE-2015-1641—99.9%
KEV—80Microsoft Office Memory Corruption Vulnerability—CVE-2023-23397—99.9%
KEV—80Microsoft Office Outlook Privilege Escalation Vulnerability—