CVE-2017-8540

Microsoft Malware Protection Engine Improper Restriction of Operations

7.8 HIGHActively exploited (CISA KEV)Public exploitEPSS 71.9%

Published26 May 2017
Added to CISA KEV3 Mar 2022
Remediation due24 Mar 2022

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".

Added to KEV: 3 Mar 2022Federal remediation due: 24 Mar 2022

Description

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Microsoft Endpoint Protectionall versions

Microsoft Exchange Server2013 · 2016

Microsoft Forefront Endpoint Protection2010

Microsoft Forefront Securityall versions

Microsoft Intune Endpoint Protectionall versions

Microsoft Malware Protection Engine≥ 1.1.13701.0 < 1.1.13704.0

Microsoft Security Essentialsall versions

Microsoft System Center Endpoint Protectionall versions

Microsoft Windows Defenderall versions

Remediation

Fixed in

Microsoft Malware Protection Engine≥ 1.1.13704.0

Patch & vendor advisories

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8540

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8540MitigationPatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8540US Government Resource
https://www.exploit-db.com/exploits/42088/ExploitThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/98703Broken LinkThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1038571Broken LinkThird Party AdvisoryVDB Entry

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2017-8540 being actively exploited?

Yes. CVE-2017-8540 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Mar 2022.

How severe is CVE-2017-8540?

CVE-2017-8540 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 71.9% probability of exploitation.

Which products are affected by CVE-2017-8540?

Affected products include Microsoft Endpoint Protection, Microsoft Exchange Server, Microsoft Forefront Endpoint Protection, Microsoft Forefront Security, Microsoft Intune Endpoint Protection, and 4 more.

How do I fix CVE-2017-8540?

Upgrade affected software to a fixed version, for example Microsoft Malware Protection Engine 1.1.13704.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2017-8540 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Running Microsoft 365?

Patching is one half. Scan your domain and check MFA, legacy authentication, admin roles and mail forwarding in two minutes, with a fix for every gap.

Run the free Microsoft 365 check

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.