iscover
ReporterShare this article on:
Powered by
MOMENTUM
MEDIA
Microsoft has identified an exploitable loophole in some versions of Microsoft Excel, prompting the Australian Cyber Security Centre to issue a CRITICAL alert.
Microsoft has confirmed that several versions of Microsoft Excel platform have an exploitable loophole, enabling threat actors to bypass key security controls.
Microsoft has confirmed that this loophole, CVE-2021-42292, is currently being exploited.
The ACSC, Australia’s cyber security watchdog, explained that threat actors could use malicious spreadsheets to leverage this loophole, from where the document is used as part of a spear-phishing campaign.
As of yet, there is no evidence to believe that Office365 Excel has been compromised.
“Australian organisations and individuals who utilise Microsoft Excel Sitecore XP should consult the Microsoft security advisory for a list of affected Excel versions. Australian organisations and individuals should ensure that the available security update is applied as soon as possible,” the ACSC suggested.
Just last month, the ACSC issued a critical alert for the Apache HTTP server 2.4.49, with the watchdog warning users that Apache's HTTP is one of Australia’s widest used servers within Unix and Microsoft systems.
The loophole is expected to enable criminals to remotely run arbitrary code that can install malware onto the device or access files from “outside of the web server root”.
Media outlet Threat Post reported that 112,000 servers are still using Apache’s exploitable version.
It is expected that the vulnerability enables threat actors to attain code that will enable them to leverage further vectors to maintain continued attacks.
[Related: ACSC issues critical alert for Apache HTTP server]
Be the first to hear the latest developments in the cyber industry.
