Yes. CISA added CVE-2021-27059 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Office contains an unspecified vulnerability that allows for remote code execution. Any organisation running the affected product should treat remediation as urgent.
How to read “being exploited in the wild” for a Microsoft Office CVE
The key question is not whether the flaw exists, but whether defenders should assume real-world abuse is already under way. For CVE-2021-27059, the practical answer is yes: the public signal is strong enough that the issue should be handled as an active exploitation event, not a theoretical vulnerability. That changes prioritisation, containment, and validation.
When Microsoft Office is the affected product, the operational concern is broad because Office content often reaches many users and endpoints. A remotely exploitable flaw in a productivity suite can become an initial access path through email, documents, or other user-driven workflows, so the response should be driven by exposure and business reach, not just patch status.
For the authoritative record of the vulnerability and its lifecycle, use the CVE Program and the NIST National Vulnerability Database alongside the vendor advisory. Those sources are the right place to confirm the exact record, product scope, and any version-specific remediation details.
What to do first when an exploited Office RCE is on your radar
Start with exposure confirmation, then move straight to remediation. If Microsoft Office is installed on endpoints that process external content, treat them as in-scope until proven otherwise. The right question is whether the vulnerable software is reachable in your environment, not whether there is already an incident ticket open.
If patching is available, apply it on the shortest possible timeline and prioritise internet-facing, high-value, and user-facing systems first. Where patching must wait, reduce the attack surface by limiting document handling from untrusted sources, tightening mail and attachment controls, and isolating affected hosts from sensitive data paths until the fix is in place.
The CISA Known Exploited Vulnerabilities Catalog is the right operational trigger for this kind of work, because it identifies vulnerabilities with reliable evidence of active exploitation and is meant to drive urgent remediation decisions.
How to verify you were not already touched
Active exploitation means the remediation question should be paired with compromise checking. Review endpoint detections, email telemetry, Office crash or process anomalies, suspicious child processes, and recent document-open activity on the systems that could have been reached through this flaw. Do not assume absence of alerts means absence of abuse.
Search for signs of post-exploitation behaviour as well as initial execution. In practice, attackers often use an RCE to stage additional payloads, gather credentials, or establish persistence after the first run. That means the hunt should look beyond the original CVE and include unusual command execution, script launchers, and unfamiliar outbound connections from Office-associated processes.
FIRST EPSS can help you prioritise exploitation likelihood in broader vulnerability triage, but a KEV listing already tells you the issue has crossed the line from possible to observed abuse. In this case, treat evidence of exploitation as the default assumption until your own validation shows otherwise.
Risk and Threat Considerations
Office RCEs are high-value because they can convert routine document handling into code execution on a trusted workstation. That creates exposure not only on the endpoint itself, but also on whatever data, sessions, and downstream services the user can reach from that machine.
Failure mechanism: An attacker delivers or induces execution through a vulnerable Office parsing or rendering path, then uses that foothold to run code in the user context, stage follow-on payloads, and pivot to adjacent resources if the host is reachable.
Impact: The immediate effect can be endpoint compromise, but the practical business risk is broader: credential theft, lateral movement, data access, and the possibility that a single user action becomes a breach starting point.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Active exploitation makes rapid vulnerability prioritisation and remediation central. |
| CIS-10 — Malware Defenses | Office RCEs often lead to payload delivery, execution, and post-exploitation activity. | |
| CIS-8 — Audit Log Management | Confirming exploitation depends on usable telemetry and endpoint evidence. | |
| Recommendation — Prioritise and remediate KEV-listed Office vulnerabilities first. Harden endpoint defenses to detect and block Office-delivered payloads. Retain and review endpoint and identity logs for signs of Office-based abuse. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The question is about urgent remediation of a known exploited software flaw. |
| SI-4 — System Monitoring | Exploitation validation requires monitoring for suspicious process and network behaviour. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-exploitation review relies on analysing telemetry for compromise indicators. | |
| Recommendation — Patch the vulnerable Office software as soon as the fix is available. Monitor Office hosts for anomalous execution and outbound activity. Review logs to validate whether the flaw was used before remediation. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset Vulnerabilities Are Identified and Documented | A KEV-listed Office issue requires identifying exposed assets quickly. |
| PR.IP-12 — Vulnerability Management Plan Is Implemented | The answer depends on urgent prioritisation and response to active exploitation. | |
| Recommendation — Identify every Office installation that could be affected. Apply an accelerated response path for exploited vulnerabilities. | ||
| OWASP ASVS | V16 — Security Logging and Error Handling | Investigating suspected exploitation depends on logs and evidence preservation. |
| Recommendation — Keep sufficient logs to investigate malicious Office execution. | ||
| MITRE ATT&CK | T1203 — Exploitation for Client Execution | A Microsoft Office RCE maps directly to client-side exploitation for execution. |
| Recommendation — Map detections and hunts to client-execution exploitation patterns. | ||
Practitioner Guidance
What to prioritise: Treat KEV-listed Office vulnerabilities as remediation-first items, not as routine backlog. If the affected software is present on systems that receive external documents or email, that environment should be at the top of the queue.
What to verify: Confirm the vulnerable Office build is actually deployed, confirm patch application on the right hosts, and confirm whether any suspicious Office-driven execution occurred before remediation. If you cannot yet verify clean state, keep the host under closer observation after patching.
Decision rule: If a patch cannot be applied immediately, reduce exposure by constraining document intake and isolating the most sensitive systems. If the same host also has access to privileged accounts, secrets, or shared file stores, escalate the response because the blast radius is materially larger.
Practitioner takeaway: For an exploited Office RCE, the real decision is not whether to patch, but how fast you can patch, validate, and rule out pre-existing compromise before attackers can reuse the foothold.
Related resources from NHI Mgmt Group
- Guide: Zero-Day and Exploited Vulnerabilities Guide
- Is CVE-2021-38646 (Microsoft Office Access Connectivity Engine Remote Code Execution) being exploited in the wild?
- Is CVE-2021-1647 (Microsoft Defender Remote Code Execution) being exploited in the wild?
- Is CVE-2021-31166 (Microsoft HTTP Protocol Stack Remote Code Execution) being exploited in the wild?
- Is CVE-2017-0262 (Microsoft Office Remote Code Execution) being exploited in the wild?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org