Exploited vulnerability · CISA KEV

Is CVE-2017-8540 exploited? Yes: in CISA KEV since 3 Mar 2022

Gociux · Microsoft Malware Protection Engine · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2017-8540, Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 3 Mar 2022, 1742 days after it was published. It affects Microsoft Malware Protection Engine. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".

What to do

1. Check whether you run it. Look for Malware Protection Engine in your asset inventory, including appliances and cloud images. Stack check lists every exploited Microsoft CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 26 May 2017.
4. Get told next time. Email alerts when CISA adds a CVE for Microsoft.

References

• nvd.nist.gov/vuln/detail/CVE-2017-8540

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in March 2022 · Microsoft scorecard · act-now radar.