{"id":"CVE-2017-0199","published":"2017-04-12T14:59:01Z","modified":"2026-06-17T00:57:15Z","title":"Microsoft Office and WordPad Remote Code Execution Vulnerability","vendor":"Microsoft","product":"Office and WordPad","tier":"core","eol":null,"description":{"text":"Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka \"Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API.\"","provenance":"source","from":"NVD"},"summary":null,"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99497,"percentile":0.99945,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0199","provenance":"source"},"vulncheckKev":{"dateAdded":"2017-04-11","exploitedFirstSeen":"2017-04-11","ransomware":true,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2017-04-11"},{"url":"https://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability","date":"2017-04-27"},{"url":"https://www.malware-traffic-analysis.net/2017/04/27/index.html","date":"2017-04-27"},{"url":"https://www.proofpoint.com/us/threat-insight/post/apt-targets-financial-analysts","date":"2017-04-27"},{"url":"https://blog.checkpoint.com/research/brokers-shadows-analyzing-vulnerabilities-attacks-spawned-leaked-nsa-hacking-tools/","date":"2017-05-25"},{"url":"https://www.proofpoint.com/us/threat-insight/post/microsoft-word-intruder-integrates-cve-2017-0199-utilized-cobalt-group-target","date":"2017-06-01"},{"url":"https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html","date":"2017-06-06"},{"url":"https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html","date":"2017-06-22"},{"url":"https://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf","date":"2017-07-01"},{"url":"https://www.threatstop.com/blog/bi-weekly-security-update-8/18/2017-0","date":"2017-08-30"}],"evidenceTotal":140,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Trojan.PDF","url":"https://otx.alienvault.com/pulse/6ad908f59762145fa16a0c89","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html","tags":["Exploit","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/97498","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1038224","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/","tags":["Exploit","Third Party Advisory"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199","tags":["Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/41894/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/41934/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/42995/","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html","tags":["Broken Link","Exploit","Third Party Advisory"]},{"url":"https://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/","tags":["Exploit","Third Party Advisory"]},{"url":"http://rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html","tags":["Exploit","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/97498","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1038224","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/","tags":["Exploit","Third Party Advisory"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199","tags":["Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/41894/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/41934/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/42995/","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html","tags":["Broken Link","Exploit","Third Party Advisory"]},{"url":"https://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0199","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"needs user interaction; not a public-facing exploit"},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: user opens crafted document","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allow remote attackers to execute arbitrary code via a crafted document","start":185,"end":256}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping","dataset-annotation"],"basisDetail":"claude-haiku-5-5: code runs via document exploitation; AnnoCTR expert entity-linking label (train split)","mappingType":"primary_impact","evidence":[{"from":"description","quote":"execute arbitrary code via a crafted document","start":211,"end":256},{"reportId":"SRC-ceefdd3b373149b188b8","quote":"o    CVE-2012-0158 [2]\r\no    CVE-2017-0199 [3]","start":6457,"end":6503},{"reportId":"SRC-ceefdd3b373149b188b8","quote":"o    CVE-2017-0199 [3]","start":6481,"end":6503},{"reportId":"SRC-ceefdd3b373149b188b8","quote":"o    CVE-2017-0199 [3]\r\no    CVE-2017-8759 [5]","start":6481,"end":6527}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-62af618b0be3e5a76bb4","title":"New Campaign Uses Remcos RAT to Exploit Victims","publisher":"fortinet.com","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims","date":"2024-11-08","mentions":[{"quote":"CVE-2017-0199 Exploited by the Excel Document","start":2036,"end":2081},{"quote":"CVE-2017-0199 is a Remote Code Execution vulnerability that exploits how Microsoft Office and WordPad parse specially crafted files.","start":2083,"end":2215},{"quote":"In the background, the CVE-2017-0199 vulnerability is exploited to download an HTA file and execute it on the recipient’s device.","start":2367,"end":2496},{"quote":"The CVE-2017-0199 vulnerability is exploited once the Excel file is opened on the victim’s device.","start":16680,"end":16778},{"quote":"FortiGuard IPS service detects the vulnerability exploit against CVE-2017-0199 with the signature “MS.Office.OLE.autolink.Code.Execution”.","start":18727,"end":18865}]},{"id":"SRC-6e22b05ad1e29c3acc68","title":"Cobalt Strike: Favorite Tool from APT to Crimeware","publisher":"Proofpoint","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/proofpoint_2021-06-29_cobalt-strike-favorite-tool-apt.txt","date":"2021-06-29","mentions":[{"quote":"2017 – [Microsoft Word Intruder Integrates CVE-2017-0199, Utilized by Cobalt Group to Target Financial","start":13705,"end":13807}]},{"id":"SRC-ceefdd3b373149b188b8","title":"Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures)","publisher":"Lab52 / S2 Grupo","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/lab52_2019-05-30_leviathan-geostrategy-and-ttp-technical.txt","date":"2019-05-30","mentions":[{"quote":"o    CVE-2017-0199 [3]","start":6481,"end":6503},{"quote":"[3] http://cve.circl.lu/cve/CVE-2017-0199","start":13675,"end":13716}]},{"id":"SRC-8ac40113865dd38a2bc6","title":"Leviathan: Espionage Actor Targets Defense & Government","publisher":"proofpoint.com","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets","date":"2017-10-16","mentions":[{"quote":"Exploitation: Microsoft Excel and Word documents with macros (sometimes password-protected), very recent vulnerabilities such as CVE-2017-0199 and CVE-2017-8759, and malicious Microsoft Publisher files","start":1061,"end":1262},{"quote":"Some of the documents exploited CVE-2017-0199 to deliver the payload.","start":3047,"end":3116},{"quote":"2024192 | ET EXPLOIT Possible CVE-2017-0199 HTA Inbound","start":16214,"end":16269},{"quote":"2024196 | ET WEB_CLIENT HTA File containing Wscript.Shell Call - Potential CVE-2017-0199","start":16273,"end":16361},{"quote":"2024197 | ET CURRENT_EVENTS SUSPICIOUS MSXMLHTTP DL of HTA (Observed in CVE-2017-0199)","start":16422,"end":16508}]},{"id":"SRC-b22236fc9db6b25e9906","title":"Emails with Backdoor Targets Russian Businesses","publisher":"trendmicro.com","url":"https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html","date":"2017-08-07","mentions":[{"quote":"These exploit a vulnerability (CVE-2017-0199) in Microsoft Office’s Windows Object Linking and Embedding (OLE) interface.","start":2168,"end":2289}]},{"id":"SRC-92352da397787b4045e8","title":"The Trail of BlackTech’s Cyber Espionage Campaigns","publisher":"trendmicro.com","url":"https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html","date":"2017-06-22","mentions":[{"quote":"CVE-2017-0199, patched by Microsoft last April, 2017","start":2132,"end":2184}]},{"id":"SRC-ff264eaf7a9f69a48903","title":"The Overlooked North Korean Actor","publisher":"services.google.com","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf","date":null,"mentions":[{"quote":"containing exploit code for CVE-2017-\r\n0199, a vulnerability in Microsoft Office","start":4766,"end":4846},{"quote":"CVE-2017-0199","start":7259,"end":7272},{"quote":"exploiting RTF vulnerability CVE-2017-0199.","start":20499,"end":20542}]},{"id":"SRC-edde8888e66c6f1a2979","title":"LockBit Ransomware 2.0 Resurfaces","publisher":"blog.cyble.com","url":"https://blog.cyble.com/2023/06/06/lockbit-ransomware-2-0-resurfaces/","date":null,"mentions":[{"quote":"This technique employed by the attackers aligns with CVE-2017-0199.","start":2867,"end":2934}]},{"id":"SRC-7337a86c8549e6b0b5ea","title":"2020 Financial Services and Insurance Industry Threat Report","publisher":"proofpoint.com","url":"https://www.proofpoint.com/sites/default/files/threat-reports/pfpt-au-tr-financial-services-and-insurance.pdf","date":null,"mentions":[{"quote":"CVE-2017-11882 JavaJavaScript\r\nCAPTCHA CVE-2018-8174\r\nCompiled HTML File\r\nAutolt HTA Packager Shell Object IP Filtering Certutil CVE-2017-8570 Application Access Token Shortcut\r\nFallout Exploit Kit CVE-2018-0802 Headers fencing XL4 macros\r\nCVE-2017-0199 CVE-2017-8759Lotus-Blue Toolkit (O365) Template Injection","start":24386,"end":24697},{"quote":"Jobs\r\nThreadkit\r\nBlackTDS\r\nLCG Kit\r\nCVE-2014-0515\r\nCVE-2017-11882\r\nJava\r\nPassword Protected\r\nCAPTCHA\r\nCVE-2018-8174\r\nCompiled HTML File\r\nAutolt HTAPackager Shell Object IP FilteringCertutil CVE-2017-8570\r\nApplication Access Token\r\nShortcut\r\nFallout Exploit Kit\r\nCVE-2018-0802\r\nHeaders fencing\r\nXL4 macros\r\nCVE-2017-0199","start":27578,"end":27897},{"quote":"obs\r\nThreadkit\r\nBlackTDS\r\nLCG Kit\r\nCVE-2014-0515\r\nCVE-2017-11882\r\nJava\r\nPassword Protected\r\nCAPTCHA\r\nCVE-2018-8174\r\nCompiled HTML File\r\nAutolt\r\nHTA\r\nPackager Shell Object\r\nIP FilteringCertutil CVE-2017-8570Application Access Token\r\nShortcut\r\nFallout Exploit Kit\r\nCVE-2018-0802\r\nHeaders fencing\r\nXL4 macros\r\nCVE-2017-0199","start":33665,"end":33985}]},{"id":"SRC-5d409288624ad2cb61d6","title":"Tech brief untangling the patchwork cyberespionage group","publisher":"documents.trendmicro.com","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf","date":null,"mentions":[{"quote":"The PowerPoint (PPT) file exploits CVE-2017-0199, an RCE vulnerability in Microsoft Office’s Windows","start":12524,"end":12624},{"quote":"an .HTA file and silently exploits it by leveraging CVE-2017-0199.","start":12732,"end":12798},{"quote":"Figure 7: The PPT containing the CVE-2017-0199 exploit","start":12802,"end":12856}]},{"id":"SRC-27a2071cb3ed3e110c59","title":"M-T RENDS2018","publisher":"static.carahsoft.com","url":"https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf","date":null,"mentions":[{"quote":"that exploited CVE-2017-0199.","start":15211,"end":15240}]},{"id":"SRC-1fa088cc0389e0509b16","title":"Operation Wilted Tulip","publisher":"clearskysec.com","url":"https://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf","date":null,"mentions":[{"quote":"Exploiting CVE-2017-0199 ............................................................................................................................","start":1547,"end":1696},{"quote":"The attackers use three document based exploitation types: exploiting CVE-2017-0199, embedding OLE","start":14860,"end":14958},{"quote":"Exploiting CVE-2017-0199","start":15250,"end":15274},{"quote":"The document exploited CVE-2017-0199, downloading an rtf file from:","start":16598,"end":16665}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-0566","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-0566","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":41894,"url":"https://www.exploit-db.com/exploits/41894","title":"Microsoft Word - '.RTF' Remote Code Execution","type":"remote","platform":"windows","date":"2017-04-18","verified":false,"provenance":"source"},{"id":41934,"url":"https://www.exploit-db.com/exploits/41934","title":"Microsoft Office Word - '.RTF' Malicious HTA Execution (Metasploit)","type":"remote","platform":"windows","date":"2017-04-25","verified":true,"provenance":"source"},{"id":42995,"url":"https://www.exploit-db.com/exploits/42995","title":"Microsoft Excel - OLE Arbitrary Code Execution","type":"dos","platform":"windows","date":"2017-09-30","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2017-04-18"},"pocGithub":{"count":17,"skipped":6,"earliest":"2017-04-13","earliestUrl":"https://github.com/SyFi/cve-2017-0199","repos":[{"name":"bhdresh/CVE-2017-0199","url":"https://github.com/bhdresh/CVE-2017-0199","stars":726,"created":"2017-04-17"},{"name":"haibara3839/CVE-2017-0199-master","url":"https://github.com/haibara3839/CVE-2017-0199-master","stars":16,"created":"2017-04-19"},{"name":"NotAwful/CVE-2017-0199-Fix","url":"https://github.com/NotAwful/CVE-2017-0199-Fix","stars":13,"created":"2017-04-18"},{"name":"SyFi/cve-2017-0199","url":"https://github.com/SyFi/cve-2017-0199","stars":12,"created":"2017-04-13"},{"name":"Exploit-install/CVE-2017-0199","url":"https://github.com/Exploit-install/CVE-2017-0199","stars":7,"created":"2017-04-22"}]},"metasploit":[{"name":"Microsoft Office Word Malicious Hta Execution","module":"exploit/windows/fileformat/office_word_hta","type":"exploit","disclosureDate":"2017-04-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/office_word_hta.rb"}],"first":{"date":"2017-04-13","source":"PoC-in-GitHub","url":"https://github.com/SyFi/cve-2017-0199"},"provenance":"source"},"exploitRefs":["http://rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html","https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/","https://www.exploit-db.com/exploits/41894/","https://www.exploit-db.com/exploits/41934/","https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html","https://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/","https://www.exploit-db.com/exploits/42995/"],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"ai"},{"stage":"primary","techniques":["T1203"],"provenance":"ai"},{"stage":"related","techniques":["T1190"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2017-04-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2017-04-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0199","provenance":"source"},{"date":"2017-04-13","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2017-04-14, Exploit-DB 2017-04-18","url":"https://github.com/SyFi/cve-2017-0199","provenance":"source"},{"date":"2017-06-22","kind":"report","label":"Named in trendmicro.com: The Trail of BlackTech’s Cyber Espionage Campaigns","url":"https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html","provenance":"machine"},{"date":"2017-08-07","kind":"report","label":"Named in trendmicro.com: Emails with Backdoor Targets Russian Businesses","url":"https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html","provenance":"machine"},{"date":"2017-10-16","kind":"report","label":"Named in proofpoint.com: Leviathan: Espionage Actor Targets Defense & Government","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets","provenance":"machine"},{"date":"2019-05-30","kind":"report","label":"Named in Lab52 / S2 Grupo: Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures)","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/lab52_2019-05-30_leviathan-geostrategy-and-ttp-technical.txt","provenance":"machine"},{"date":"2021-06-29","kind":"report","label":"Named in Proofpoint: Cobalt Strike: Favorite Tool from APT to Crimeware","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/proofpoint_2021-06-29_cobalt-strike-favorite-tool-apt.txt","provenance":"machine"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-0566","provenance":"source"},{"date":"2024-11-08","kind":"report","label":"Named in fortinet.com: New Campaign Uses Remcos RAT to Exploit Victims","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims","provenance":"machine"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1666},"priority":{"score":88.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3488 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9994"},{"name":"Named in threat reports","points":10.0,"detail":"12 reports"},{"name":"Public exploit code","points":5.0,"detail":"6 NVD references tagged Exploit; 3 Exploit-DB entries; 1 NVD exploit link; 17 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}