CVE-2017-0199Vulnerability
Microsoft Office and WordPad Remote Code Execution Vulnerability
Reported by 6 independent sources · first reported by Group-IB · last reported
Last reported 23 days ago
Fix due 3 May 2022
Used by ransomware: knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026
What the reports say
8 reports, newest first · the exact sentence from each-
Panorama de ciberamenazas en América Latina: balance del primer semestre de 2026“CVE-2017-0199 (58,3% del total de exploits): Presente de forma homogénea en toda América Latina y encabezando el volumen absoluto de incidentes de explotación en múltiples industrias.”
-
Beware of Phishing Emails That Disguise Themselves as Project Material Purchase Requests“However, the document contains the CVE-2017-0199 vulnerability, which exploits OLE objects.”
-
Panorama de amenazas digitales en México: qué cambió en el primer semestre de 2026“Más del 90% de este volumen estuvo concentrado en fallas divulgadas en 2017 sobre suites de productividad, encabezadas por CVE-2017-0199.”
-
August 2026 CVE Landscape“CVE-2017-0199”
-
Exploits and vulnerabilities in Q2 2026“CVE-2017-0199: a vulnerability in Microsoft Office and WordPad that allows an attacker to gain control over the system”
-
Rapid Response: Microsoft Office RCE - “Follina” MSDT Attack“Currently, Windows Defender will detect the known in-the-wild malicious sample as CVE-2017-0199.”
-
Kremlin RATs from Nigeria“However, the document exploits the CVE-2017-0199 vulnerability, which executes a command that loads the payload hxxp://office-cloud-reserve.com/hydro.exe.”
-
Petya starts with Ukraine and then goes global“When the malicious attachment is opened, it employs a recent vulnerability: CVE-2017-0199.”
Indicators reported together
named in the same reportsAlso named with it: CVE-2017-11882, CVE-2022-0847, CVE-2025-49113, CVE-2026-68820, CVE-2026-65400, CVE-2026-60004, CVE-2026-64849, CVE-2026-33824, CVE-2026-43284, CVE-2026-0300, CVE-2026-33017, CVE-2025-8088, CVE-2018-0802, CVE-2023-38831, CVE-2025-6218, CVE-2026-31431, CVE-2026-43500, CVE-2026-46300, CVE-2026-31635, CVE-2026-43494
Thanks — we review every report.