Yes. CISA added CVE-2015-1770 to its Known Exploited Vulnerabilities catalogue on 28 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Office allows remote attackers to execute arbitrary code via a crafted Office document. Any organisation running the affected product should treat remediation as urgent.
How to read CVE-2015-1770 as a live exploitation signal
CISA’s inclusion of CVE-2015-1770 in KEV is the practical answer to “is it being exploited in the wild?” for defenders. It means the issue should be treated as an active exposure, not a theoretical weakness, and it justifies prioritising remediation over routine patch queues. For tracking and validation, pair the KEV record with the CISA Known Exploited Vulnerabilities Catalog and the NIST National Vulnerability Database.
Microsoft Office document exploitation is especially relevant because the attack path starts with a file that users may open as part of normal work. That makes exposure broad wherever Office is used to handle untrusted attachments, shared files, or externally sourced content. The core question is less “does the software exist on a system?” and more “can a crafted document reach a user or workflow that will process it?”
Because the weakness is remote code execution through a crafted Office document, the most important operational distinction is whether untrusted document intake is controlled. If mail gateways, sandboxing, attachment controls, and user behaviour do not reliably reduce delivery and execution, the vulnerability remains exploitable even before patching is complete. Organisations should also assume that older Office deployments and long-lived desktop images increase the likelihood that the flaw is still reachable.
What response should follow when exploitation is known
When a vulnerability is already in KEV, response should be driven by exposure and exploitability, not by whether local telemetry has already confirmed abuse. That means confirming where Microsoft Office is installed, which endpoints or virtual desktops can open externally supplied documents, and whether any compensating controls meaningfully interrupt the attack path. The urgency comes from the combination of active exploitation and a user-triggered delivery vector.
Remediation should be followed by targeted verification, not just package deployment. After updating or mitigating, confirm that the vulnerable Office instances are no longer present in inventory, that control exceptions are documented, and that systems which could have processed suspicious documents are reviewed for signs of follow-on execution. Where patching is delayed, restrict document sources, isolate high-risk users, and raise monitoring around Office launching child processes or loading unusual content.
For incident teams, this is also a good moment to review whether the document-based entry point was part of a broader campaign. Even when a KEV entry does not mention ransomware, exploitation can still be used for initial access, payload staging, or credential theft. That is why the right response is a combination of patching, exposure reduction, and compromise assessment rather than patching alone.
What defenders should verify before closing the case
Do not treat “patched” as the end state until you can verify exposure, execution paths, and any likely aftermath. A vulnerable Office version on an endpoint that cannot process untrusted files is a different risk from the same version on a user workstation exposed to email attachments, file shares, and external collaboration. The asset, the delivery path, and the user population all matter.
It is also worth checking whether the organisation has rotated any credentials, sessions, or tokens that may have been exposed if the vulnerability led to code execution on an endpoint with access to business services. That step is not automatic for every case, but it becomes material when Office was present on systems that can reach sensitive accounts, VPNs, cloud apps, or privileged admin tools.
Risk and Threat Considerations
Active exploitation changes the risk posture from hypothetical to operational. A document-based Office flaw can be used for initial access, which means the real danger is often the second stage: payload delivery, persistence, or lateral movement after a user opens a file that looks routine.
Failure mechanism: An attacker sends or places a crafted Office document where a user or automated workflow will open it, triggering memory corruption and arbitrary code execution before normal user awareness or routine review can stop it.
Impact: The resulting code execution can expose endpoint data, enable theft of session material or credentials, and create an entry point for broader compromise across email, file, and identity-connected services.
Practitioner Guidance
What to prioritise: Triage this as an exploited vulnerability, not a generic Office update. Focus first on assets that regularly open external documents, because those are the systems most likely to be hit first and most likely to be abused again if left unverified.
What to verify: Confirm current Office exposure, the status of any compensating controls around document handling, and whether suspicious document activity or unexpected Office child processes appeared before remediation. If any such signals exist, pair remediation with a compromise review.
Decision rule: If patching cannot happen immediately, treat the environment as temporarily at risk and narrow the attack surface by limiting untrusted document intake, segmenting high-value users, and increasing detection around Office execution patterns.
Practitioner takeaway: The key judgement is not whether exploitation is possible, but whether your current document workflow still gives an attacker a realistic path to reach code execution before your controls intervene.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Active exploitation makes prioritised vulnerability remediation central. |
| CIS-10 — Malware Defenses | Crafted documents commonly deliver malicious code through Office workflows. | |
| Recommendation — Prioritise and remediate the exploited Office flaw first, then verify exposure reduction. Harden email and endpoint controls that detect or block malicious document delivery. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | Known exploited software flaws require timely correction and follow-up verification. |
| SI-3 — Malicious Code Protection | Document-based exploitation often relies on malware delivery through user-opened files. | |
| RA-5 — Vulnerability Monitoring and Scanning | The answer depends on confirming exposure and tracking affected systems. | |
| Recommendation — Patch or mitigate the Office weakness and confirm the remediation was applied everywhere. Use malicious code protections to reduce the chance that a crafted Office file executes. Scan for vulnerable Office deployments and track remediation until exposure is closed. | ||
Practitioner Guidance
What to prioritise: Triage this as an exploited vulnerability, not a generic Office update. Focus first on assets that regularly open external documents, because those are the systems most likely to be hit first and most likely to be abused again if left unverified.
What to verify: Confirm current Office exposure, the status of any compensating controls around document handling, and whether suspicious document activity or unexpected Office child processes appeared before remediation. If any such signals exist, pair remediation with a compromise review.
Decision rule: If patching cannot happen immediately, treat the environment as temporarily at risk and narrow the attack surface by limiting untrusted document intake, segmenting high-value users, and increasing detection around Office execution patterns.
Practitioner takeaway: The key judgement is not whether exploitation is possible, but whether your current document workflow still gives an attacker a realistic path to reach code execution before your controls intervene.
Related resources from NHI Mgmt Group
- Guide: Zero-Day and Exploited Vulnerabilities Guide
- CVE-2015-1770 (Microsoft Office Uninitialized Memory Use)
- Is CVE-2010-3962 (Microsoft Internet Explorer Uninitialized Memory Corruption) being exploited in the wild?
- Is CVE-2015-2502 (Microsoft Internet Explorer Memory Corruption) being exploited in the wild?
- Is CVE-2026-21509 (Microsoft Office Security Feature Bypass) being exploited in the wild?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org