Exploited vulnerability · CISA KEV

Is CVE-2016-3351 exploited? Yes: in CISA KEV since 24 May 2022

Gociux · Microsoft Internet Explorer and Edge · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2016-3351, Microsoft Internet Explorer and Edge Information Disclosure Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 24 May 2022, 2078 days after it was published. It is known to be used in ransomware campaigns. It affects Microsoft Internet Explorer and Edge. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.

What to do

1. Check whether you run it. Look for Internet Explorer and Edge in your asset inventory, including appliances and cloud images. Stack check lists every exploited Microsoft CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 14 Sep 2016.
4. Get told next time. Email alerts when CISA adds a CVE for Microsoft.

References

• nvd.nist.gov/vuln/detail/CVE-2016-3351

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in May 2022 · Microsoft scorecard · act-now radar.