Yes. CISA added CVE-2016-0162 to its Known Exploited Vulnerabilities catalogue on 24 May 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. Any organisation running the affected product should treat remediation as urgent.
How CISA’s KEV Listing Changes the Answer
CVE-2016-0162 is not just a historical browser flaw, it is a vulnerability CISA has already judged as actively exploited. For practitioners, that changes the question from “is this real?” to “have we confirmed whether any exposed systems still depend on Internet Explorer handling that can be abused by hostile JavaScript?”
When a vulnerability enters the KEV catalogue, the operational priority becomes exposure confirmation and rapid removal of the affected software path. Treat the affected browser surface as a live risk until you have verified whether it is still present in your environment and whether any dependent workflows still rely on it.
What the Vulnerability Means Operationally
The issue is an information disclosure weakness in Internet Explorer’s JavaScript handling. In practice, that means untrusted script can cause data exposure through the browser’s own execution and rendering behaviour, which is why browser hardening and controlled execution contexts matter so much for legacy web access paths.
This type of flaw is especially relevant in environments that keep older browser components around for compatibility, because the attack surface often survives long after the browser is no longer a daily user choice. If a legacy application still requires the product, the browser becomes part of the trust boundary for that application.
For teams trying to understand the impact, the relevant question is not only whether the browser is installed, but whether users can still launch it, whether compatibility modes keep it reachable, and whether enterprise controls allow untrusted web content to execute in a context that exposes sensitive data.
Why Active Exploitation Matters for Response Priority
Active exploitation means the flaw has moved from theoretical exposure to likely attacker use. That shifts remediation priority above ordinary backlog work, because the value of the weakness is no longer just that it exists, but that attackers can already be using it as a reliable entry or disclosure path.
For a browser disclosure flaw, the immediate concern is not only the browser itself, but what the browser can reach: session data, intranet content, internal applications, and any information that becomes visible when JavaScript runs in a trusted user session. That is why legacy browser exposure often becomes a broader enterprise risk rather than a single-endpoint issue.
Use CISA Known Exploited Vulnerabilities Catalog and NIST National Vulnerability Database to confirm the public record, then cross-check whether your browser estate still includes the affected product or any compatibility dependency that keeps it alive.
Risk and Threat Considerations
Browser vulnerabilities that disclose information through script handling are attractive because they sit close to the user session and can expose data without needing obvious malware installation. In an enterprise, the same flaw can affect many users at once if a legacy browser remains enabled by policy, packaging, or application compatibility.
Failure mechanism: Untrusted JavaScript executes in a browser context that improperly protects or isolates information, allowing sensitive data to be disclosed to attacker-controlled content or to a hostile page embedded in a normal workflow.
Impact: Exposed session data, internal content, or other information can support follow-on intrusion, phishing, privilege abuse, or lateral movement, especially when the browser is used for authenticated access to internal services.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Active exploitation calls for rapid exposure detection and remediation prioritisation. |
| Recommendation — Prioritise and remediate KEV-listed browser exposure quickly. | ||
| NIST CSF 2.0 | PR.PS-03 — Configuration Management | Legacy browser enablement and compatibility paths are configuration issues that expand attack surface. |
| ID.RA-01 — Asset Vulnerability Identification | You must identify whether the affected product still exists in the environment. | |
| Recommendation — Remove or restrict the affected browser path in production. Confirm whether vulnerable Internet Explorer exposure still exists. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | KEV-listed flaws require monitoring and validation of exposure across the estate. |
| Recommendation — Scan for and validate any remaining exposure to the flaw. | ||
| ISO/IEC 27001:2022 | A.8.8 — Management of technical vulnerabilities | An actively exploited vulnerability fits vulnerability management and urgent remediation expectations. |
| Recommendation — Track, prioritise, and remediate the exposed browser vulnerability. | ||
Practitioner Guidance
What to verify: Confirm whether Internet Explorer is still installed, enabled, or reachable through compatibility settings, and verify whether any business workflow still requires it. If the answer is yes, treat the environment as exposed until that dependency is removed or isolated.
Decision rule: If the affected browser path is still reachable in production or by privileged users, prioritise removal, restriction, or isolation before treating the issue as a routine patch item. If immediate removal is impossible, constrain access to the smallest possible user set and separate it from sensitive browsing activity.
Practitioner takeaway: With a KEV-listed browser flaw, the important judgement is whether the vulnerable execution path still exists anywhere in your estate, because once it does, exposure management is more urgent than debating exploitability.
Related resources from NHI Mgmt Group
- Guide: Enterprise Browser and Browser Security Guide
- Is CVE-2016-3351 (Microsoft Internet Explorer and Edge Information Disclosure) being exploited in the wild?
- Is CVE-2016-3298 (Microsoft Internet Explorer Messaging API Information Disclosure) being exploited in the wild?
- How do you patch or mitigate CVE-2016-0162 (Microsoft Internet Explorer Information Disclosure)?
- Is CVE-2019-0676 (Microsoft Internet Explorer Information Disclosure) being exploited in the wild?