Is CVE-2017-0199 (Microsoft Office and WordPad Remote Code Execution) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2017-0199 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files.

What CISA’s KEV Listing Tells You About Active Exploitation

For a CVE like this, the practical question is not whether the flaw exists, but whether you should treat it as an active exposure. A KEV listing means CISA has enough evidence to consider it a real-world exploitation problem, so defenders should move from inventorying the issue to verifying exposure, prioritising remediation and assuming attacker interest until proven otherwise.

That matters because Office-format attacks are often delivered through normal document handling paths, so the vulnerable surface can sit inside everyday user workflows rather than an obvious internet-facing service. If the product is present, the next question is which systems, users and email or file-transfer paths can still reach it.

How Exploitation Typically Reaches Users and Endpoints

Office and document-parsing flaws usually become dangerous when a crafted file is opened or previewed. The exploit path often depends on social delivery, file shares, email attachments or download links, then hands execution to the local application context. Once that happens, the attacker no longer needs the initial message to keep working, because the payload has already crossed the trust boundary.

That is why this type of issue is operationally different from a simple software bug. The vulnerable parser is part of a trusted application stack, so the exploit can blend into normal content handling and evade casual inspection until after code execution has already occurred.

What to Do When You Cannot Patch Immediately

If patching is delayed, reduce exposure by narrowing who can receive or open risky file types, hardening email and web download controls, and isolating high-risk users or endpoints that still need to handle external documents. The goal is not perfect prevention, but shrinking the number of systems that can reach the vulnerable parser before the fix is in place.

Because exploitation may arrive through ordinary files rather than a dedicated exploit service, compensating controls should focus on the delivery path and the execution boundary. Where possible, block unnecessary document formats, restrict preview or rendering features, and increase scrutiny on inbound files that originate outside known business workflows.

Risk and Threat Considerations

A KEV-listed document-processing flaw creates immediate exposure because successful exploitation can occur through content users already trust. The main risk is not just remote code execution, but the follow-on compromise of endpoints, credentials and downstream access paths that those endpoints can reach.

Failure mechanism: A specially crafted file is opened or rendered by the vulnerable application, and the parser reaches attacker-controlled code execution before normal user awareness or routine inspection can intervene.

Impact: Attackers can establish an initial foothold, pivot into mailboxes, shared drives or adjacent systems, and use the compromised endpoint as a launch point for broader intrusion or ransomware deployment.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes rapid identification and remediation the key control.
	CIS-10 — Malware Defenses	Document-delivered exploitation often relies on malicious payloads reaching endpoints.
Recommendation — Prioritise and remediate KEV-listed exposures first. Harden email, web and endpoint defenses against malicious documents.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE requires prompt remediation once active exploitation is confirmed.
	SI-3 — Malicious Code Protection	Crafted files can deliver malicious code through trusted document handling.
	RA-5 — Vulnerability Monitoring and Scanning	You must confirm where the vulnerable product remains exposed.
Recommendation — Track, assess and remediate the flaw without delay. Inspect and block malicious content entering user workflows. Continuously identify assets still affected by the CVE.

Practitioner Guidance

What to verify: Confirm where Microsoft Office or WordPad is still present, which endpoints can receive untrusted documents, and whether compensating controls are actually intercepting the file types and delivery routes you care about. A KEV entry should trigger validation, not assumption.

Decision rule: If the asset can open external documents and is business-critical, treat it as a near-term remediation priority even before you have evidence of abuse. If the system is already constrained by virtualisation, application control or strong content filtering, use that to narrow blast radius, not to delay the fix.

Practitioner takeaway: For exploited document-parsing CVEs, exposure is the first problem and compromise is the second, so the right response is to verify reachability, reduce document-handling risk and patch with urgency rather than waiting for local signs of abuse.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org