How do you patch or mitigate CVE-2021-40444 (Microsoft MSHTML Remote Code Execution)?

CISA’s required action for CVE-2021-40444 is to apply updates per vendor instructions. In practice, find every instance of Microsoft MSHTML in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

What to do first when CVE-2021-40444 is in scope

Start by building a complete inventory of where Microsoft MSHTML is present, then decide whether each instance can be updated, mitigated, or isolated. The practical question is not just “is it patched?” but “can this code path still be reached from untrusted content?” For an actively exploited issue, exposure reduction is part of the fix, not a fallback.

For a patch-first response, use the vendor update instructions and pair them with exploit-priority triage from Zero-Day and Exploited Vulnerabilities Guide. If you are tracking remediation urgency, the CISA Known Exploited Vulnerabilities Catalog is the authoritative place to confirm that this flaw is being treated as actively exploited and should be handled as an emergency item.

How to mitigate when you cannot patch immediately

When updates cannot be deployed at once, the goal is to block the delivery path that makes MSHTML reachable. That usually means removing internet exposure, restricting risky document handling, or taking the affected product out of service until a supported fix is in place. Temporary mitigations should be treated as time-bounded, because they reduce opportunity rather than remove the vulnerability.

Use the vendor’s documented workaround exactly as written, then validate that users can no longer open content that would invoke the vulnerable component from external sources. If your environment has a broad vulnerability backlog, the Vulnerability Management Guide is useful for keeping emergency mitigation, exception handling, and verification separate from routine patch workflows. For independent remediation planning, the NIST National Vulnerability Database and CVE Program remain the canonical references for record-level tracking.

How to check for earlier exploitation and follow-up compromise

Because this flaw was exploited in the wild, patching alone is not the end of the response. Review endpoint, email, browser, and document-handling telemetry for signs that malicious content was opened before the fix landed, and look for suspicious child processes, dropped files, script execution, or unusual network activity tied to document delivery. The objective is to confirm whether the vulnerability was used as an initial access path.

Post-patch hunting should focus on the likely attack chain, not just the CVE itself. If you need a framework for what to look for next, the MITRE ATT&CK Enterprise Matrix helps map document-driven execution, payload staging, and follow-on activity to common adversary techniques. For a broader exploitation case study, Gladinet Hard-Coded Keys RCE Exploitation is not the same vulnerability, but it illustrates the same operational pattern of an RCE being used as an entry point for deeper compromise.

Risk and Threat Considerations

MSHTML sits in a high-risk position because it can be reached through content users trust, which makes exploitation attractive for initial access and payload delivery. Once the vulnerable code path is triggered, the attacker does not need to “stay” inside the document flow, they can pivot into code execution, staging, and broader compromise.

Failure mechanism: Malicious content reaches the vulnerable MSHTML processing path, the flaw is triggered before the user recognises the document as hostile, and the attacker gains an execution foothold on the endpoint.

Impact: The likely consequence is endpoint compromise, post-exploitation activity, and possible lateral movement if the affected host has access to internal resources or sensitive credentials.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	CVE-2021-40444 needs rapid triage, patching and verification.
Recommendation — Prioritise, patch and verify the exploited vulnerability before returning the asset to normal service.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE requires vendor patching and documented mitigation tracking.
	SI-4 — System Monitoring	Post-patch hunting is needed to detect earlier exploitation of the flaw.
Recommendation — Apply the vendor fix or approved mitigation and track remediation to closure. Review telemetry for signs of exploitation before and after remediation.
NIST CSF 2.0	PR.PS-03 — Platform Security	Reducing exposure and applying secure updates are central to handling an exploited software flaw.
Recommendation — Reduce attack surface and deploy vendor updates or compensating controls promptly.
OWASP ASVS	V13 — Configuration	Mitigation depends on secure configuration, exposure removal and validated updates.
Recommendation — Verify the secure configuration change or workaround is actually in effect.

Practitioner Guidance

What to prioritise: Treat internet-facing or user-reachable instances as the highest priority, especially where email or document workflows can invoke MSHTML. If a system cannot be patched quickly, assume exposure remains until the risky path is removed.

What to verify: Confirm the vendor update or mitigation actually blocks the vulnerable behavior, then validate that the affected software version no longer accepts untrusted content through the exposed path. If you only verified installation status, you have not yet verified exposure reduction.

Practitioner takeaway: For an exploited RCE, the right decision standard is blast radius, not convenience, patch fast, isolate where you must, and hunt for pre-patch activity before you declare the issue closed.