CVE-2021-41368: Microsoft 365 Apps RCE Vulnerability

CVE-2021-41368 Overview

CVE-2021-41368 is a remote code execution vulnerability in Microsoft Access that affects multiple supported Office releases. Despite the "remote code execution" label, the attack vector is local and requires user interaction. An attacker crafts a malicious Access database file and convinces a user to open it. Successful exploitation results in code execution in the context of the current user.

Microsoft published the advisory on November 10, 2021 as part of the monthly security release. The Zero Day Initiative tracks this issue as ZDI-21-1309.

Critical Impact
Opening a malicious Access file allows attackers to execute arbitrary code with the privileges of the logged-on user, enabling full compromise when an administrator account is targeted.

Affected Products

Microsoft 365 Apps for Enterprise
Microsoft Office 2013 SP1, Office 2016, Office 2019
Microsoft Office Long Term Servicing Channel 2021

Discovery Timeline

2021-11-10 - Microsoft releases security advisory for CVE-2021-41368
2021-11-10 - CVE-2021-41368 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-41368

Vulnerability Analysis

The vulnerability is a client-side remote code execution flaw in Microsoft Access. Attackers deliver a weaponized Access database to a target through email, a shared drive, or a web download. Code execution occurs when the victim opens the file with a vulnerable Access build.

The attack vector is local and the attack complexity is low. No privileges are required on the target machine, but user interaction is mandatory. The resulting impact covers confidentiality, integrity, and availability — the attacker inherits the user's permissions on the host.

The NVD has not assigned a specific CWE classification for this issue, listing it as NVD-CWE-noinfo. Public references from Microsoft and the Zero Day Initiative do not disclose the underlying memory or parsing defect.

EPSS data places the probability of exploitation at roughly 3.05%, in the 86th percentile, indicating elevated attacker interest compared to most CVEs of this class.

Root Cause

Microsoft has not published technical root cause details. The Microsoft Security Response Center advisory identifies the flaw as a code execution defect handled through the Access file parsing path. No CWE has been assigned and Microsoft has not released sample proof-of-concept material.

Attack Vector

Exploitation requires social engineering. The attacker prepares a crafted .accdb, .mdb, or related Access file and lures the user into opening it. Office's Protected View and Mark-of-the-Web warnings can reduce, but do not eliminate, the risk if the user clicks through and enables content.

No verified public exploit code is available for CVE-2021-41368. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Detailed technical analysis is referenced in the ZDI Advisory ZDI-21-1309.

Detection Methods for CVE-2021-41368

Indicators of Compromise

Microsoft Access (MSACCESS.EXE) spawning child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe
Inbound Access database files (.accdb, .accde, .mdb, .mde) arriving via email attachments or downloads from untrusted sources
Unexpected outbound network connections initiated by MSACCESS.EXE shortly after a document is opened
New persistence artifacts (Run keys, scheduled tasks, Office add-ins) created in the same session that opened an Access file

Detection Strategies

Hunt for parent-child process relationships where MSACCESS.EXE launches scripting hosts or living-off-the-land binaries
Inspect email gateway logs for Access attachments delivered from external senders and quarantine for sandbox analysis
Correlate Office telemetry (Microsoft Defender for Office 365 or equivalent) with endpoint process and network events
Apply Microsoft Office Attack Surface Reduction (ASR) rules that block Office applications from creating child processes

Monitoring Recommendations

Enable Office macro and content telemetry forwarding to a central SIEM or data lake for correlation
Track installed Office build numbers against the patched versions listed in the Microsoft advisory
Alert on Access executions originating from temporary directories such as %TEMP%, Downloads, or Outlook's secure temp folder

How to Mitigate CVE-2021-41368

Immediate Actions Required

Apply the November 2021 Microsoft Office security updates to all systems running Access, Office 2013 SP1, 2016, 2019, Microsoft 365 Apps, and Office LTSC 2021
Confirm patched build numbers using File > Account > About Access or by querying installed Office versions through endpoint management tooling
Block inbound .accdb, .accde, .mdb, and .mde attachments at the mail gateway when business workflows allow
Enable Microsoft Defender ASR rules that block Office child processes and obfuscated script execution

Patch Information

Microsoft addressed CVE-2021-41368 in the November 2021 Patch Tuesday release. Refer to the Microsoft Security Advisory CVE-2021-41368 for the full list of update packages, KB identifiers, and affected build ranges. Microsoft 365 Apps subscribers receive the fix through the standard update channel.

Workarounds

Enforce Protected View for files originating from the internet and Outlook attachments through Group Policy
Restrict opening Access database files to trusted locations only, using the Office Trust Center
Remove Microsoft Access from endpoints that do not require it as part of standard Office deployment customization

bash

# Group Policy registry settings to enforce Protected View for Access files
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Access\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Access\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Access\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f