CVE-2016-3288

Think of Internet Explorer as the front door to the internet. This flaw lets a specially made webpage confuse IE11’s internal handling of data—either making it crash or potentially taking control of the computer as the currently logged-in user. It’s like someone creating a booby-trapped page that only needs the victim to open it in that specific browser.

This matters if your business still runs Microsoft Internet Explorer 11 on employee computers, especially if staff browse the web using IE11. The risk doesn’t require the attacker to have a login to your system; instead, it depends on whether a victim visits a maliciously crafted webpage. Because the default-config reachability is not “on by default,” it’s mainly a concern when IE11 is actually being used and an attacker can reach an end user through normal browsing.

This should be treated as urgent patching work because public exploits exist and attackers have a straightforward path: get a user to open a malicious page in Internet Explorer 11. Even though exploitation needs user interaction, once a user is targeted, the impact can be serious because code can run under the logged-in user’s privileges. Verdict: AMBER (act quickly, especially on any machines that still use IE11).