Is CVE-2018-8298 (ChakraCore Scripting Engine Type Confusion) being exploited in the wild?

Yes. CISA added CVE-2018-8298 to its Known Exploited Vulnerabilities catalogue on 3 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. The ChakraCore scripting engine contains a type confusion vulnerability which can allow for remote code execution. Any organisation running the affected product should treat remediation as urgent.

Why CISA’s KEV Listing Means This CVE Should Be Treated as Actively Exploited

The key issue is not whether the flaw is theoretically dangerous, it is that CISA placed CVE-2018-8298 in the Known Exploited Vulnerabilities catalogue, which is CISA’s signal that reliable exploitation evidence exists. For defenders, that moves this from ordinary vulnerability management into urgent exposure reduction, particularly for any system where the ChakraCore scripting engine is still present.

Because the vulnerability is a type confusion issue that can enable remote code execution, the practical question is whether the affected product is reachable in your environment and whether the vulnerable component is loaded in any exposed workflow. If it is, exploitation can turn a software bug into direct execution on the host, which is why KEV-listed flaws are triaged ahead of routine backlog items.

What to Check Before You Assume You Are Safe

Start by confirming whether the affected product is actually deployed, where it is installed, and whether any internet-facing or high-trust internal systems depend on it. Many teams miss exploited vulnerabilities because they scan only the headline application and do not trace embedded runtimes, libraries, bundled engines, or legacy dependencies that can still expose the flaw.

Inventory matters here because remediation urgency depends on exposure, not just product ownership. A dormant system can still be a valid attack target if it is reachable for maintenance, remote administration, or scheduled jobs, and a component used by one application may exist on several hosts even when only one business owner remembers it.

Remediation Priority When the Fix Cannot Wait

For a KEV-listed issue like this, the default posture should be to patch or otherwise remove exposure as soon as operationally possible, using the vendor advisory and the CISA KEV entry for the authoritative fix path. If immediate remediation is blocked, reduce exposure by taking the affected service out of internet-facing paths, restricting who can reach it, and disabling any feature or integration that loads the vulnerable engine unnecessarily.

When patching is delayed, treat the gap as a temporary exception that needs an owner, a deadline, and compensating controls. The main goal is to shrink the reachable attack surface quickly, because once a flaw is known to be actively exploited, waiting for a convenient maintenance window is often the wrong tradeoff.

Risk and Threat Considerations

Actively exploited flaws create a narrower but more dangerous decision window: the threat is not just exploitation, but exploitation before your team finishes validation, change approval, or staged rollout. In practice, that means the first failure is often delayed action, incomplete asset visibility, or assuming that a low-visibility legacy component is not reachable.

Failure mechanism: An attacker uses the type confusion weakness to trigger remote code execution in a system that loads ChakraCore, then uses the initial foothold to run code, stage payloads, or pivot to adjacent resources before defenders react.

Impact: Successful exploitation can lead to full host compromise, data access, service disruption, and a wider incident if the affected system has privileged network reach or access to sensitive internal resources.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.RA-01 — Asset Vulnerabilities Identified and Managed	Active exploitation requires exposure discovery and vulnerability awareness.
	PR.PS-05 — Installation Restrictions and Trusted Software	Fixing exploited software depends on controlled deployment of approved updates.
Recommendation — Identify all ChakraCore-enabled assets and prioritise exposed instances for remediation. Deploy the vendor fix through controlled software change and remove vulnerable builds.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	KEV-listed exploitation calls for continuous identification of vulnerable assets.
	SI-2 — Flaw Remediation	This CVE requires urgent patching or mitigation once exposure is confirmed.
Recommendation — Scan for ChakraCore exposure and track remediation until the vulnerable component is removed. Apply the vendor remediation or compensating mitigation without delay.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes prioritised vulnerability handling directly relevant.
Recommendation — Prioritise this KEV-listed flaw ahead of routine backlog items and verify closure.

Practitioner Guidance

What to verify: Confirm the exact asset set that can load ChakraCore, not just the application name, and verify whether those instances are still reachable from user-facing or administrative networks. If you cannot produce that inventory quickly, treat the exposure as higher risk until you can.

Decision rule: If the vulnerable component is present on any system that matters to the business, prioritise immediate remediation over normal patch sequencing; if remediation must wait, document the exception, constrain access, and plan verification that the workaround actually removes the exploitable path.

Practitioner takeaway: For a KEV-listed vulnerability, the right question is not “is it patched yet?” but “how quickly can we eliminate or contain every reachable instance before exploitation reaches us first?”