CVE WatchAug 10, 2026

CVE-2021-38646

Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

CVSS

7.8

High

EPSS

8.0%

p94

KEV

YES

Mar 28, 2022

Exploit Today

0-100

Published: Sep 15, 2021 · Last modified: Aug 10, 2026

EPSS · 30d

4.4%EPSS · 30 days8.0%

2026-08-022026-08-31

KEV catalog record

Product

Microsoft / Office

Vulnerability

Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

Added to KEV

Mar 28, 2022

Remediate by

Apr 18, 2022

Known ransomware use

Yes

Summary description

Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-38646

Technical description

Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2023-217157.3 HIG

95.8%

KEV—79Microsoft Office Publisher Security Feature Bypass Vulnerability12d CVE-2021-422927.8 HIG

98.6%

KEV—80Microsoft Excel Security Feature Bypass12d CVE-2021-270597.6 HIG

92.9%

KEV—78Microsoft Office Remote Code Execution Vulnerability12d CVE-2017-11882—

100.0%

KEV—80Microsoft Office Memory Corruption Vulnerability—CVE-2023-23397—

99.9%

KEV—80Microsoft Office Outlook Privilege Escalation Vulnerability—CVE-2015-1641—

99.9%

KEV—80Microsoft Office Memory Corruption Vulnerability—