CVE-2017-8635

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.07.5High EPSS percentile99th56% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2017-08-08Updated 2026-05-13Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Microsoft Corporation Microsoft Scripting EngineAffected: Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows…Upgrade to: not statedStated by: CVE record
Microsoft Corp Internet ExplorerAffected: 10Upgrade to: not statedStated by: BDU

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your PCs run an affected Windows version and use the affected browsers (Internet Explorer and/or Microsoft Edge) and the Microsoft Scripting Engine.
Review and apply Microsoft’s official security guidance for CVE-2017-8635 on your affected systems (install the recommended updates/hotfixes and confirm they’re present).
Reduce exposure by training staff to avoid opening unexpected links or “crafted” files, since an attacker needs user interaction to trigger this.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user due to the way that JavaScript engines render when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.

In plain language

Written by AI from the record

This Windows web-browsing security flaw lets attackers run code on your PC only after a user opens a malicious link or file—so a typical small business should worry, especially if staff browse the web with affected Windows and browsers and often open unexpected attachments.

CVE-2017-8635 is a scripting-engine memory corruption issue in Microsoft browsers (Internet Explorer, Microsoft Edge) and the Microsoft Scripting Engine that can lead to remote code execution in the current user context when a victim runs a specially crafted JavaScript script via a malicious website or file; public exploit(s) exist, and no CISA KEV listing was found.

If you're affected

Account takeover and malware installation
Ransomware risk from user compromise
Business data theft
System disruption

What is it

Think of this like a bug in the “brains” that runs web scripts on Windows. If someone convinces a user to open a malicious link or file, the attacker may be able to make the user’s computer run their code. That can then lead to malware getting installed under the user’s privileges.

Who is affected

This matters if you run Windows versions listed in the CVE and your users browse with Microsoft Internet Explorer and/or Microsoft Edge, which rely on the Microsoft Scripting Engine. An attacker does not need a login, but they do need the user to actively open a malicious link or crafted file. Reachability in default configurations is not confirmed in the findings, so the practical gate is whether you use affected browsers/Windows and whether users can be tricked into opening malicious content.

How urgent is it

This is an AMBER issue because there is at least one public exploit, and attackers can trigger it through common browsing behavior (a user opening a malicious link/file). While it requires user interaction, that’s a common real-world situation for small businesses.

What to do — in detail

Confirm exposure (check across endpoints):
- Identify whether any devices are on the affected Windows versions named in the CVE description (Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1/RT 8.1, Windows Server 2012/R2, Windows 10 Gold/1511/1607/1703, Windows Server 2016).
- Confirm whether Internet Explorer and/or Microsoft Edge are in use on those systems (the flaw is in Microsoft browsers using the Microsoft Scripting Engine).
Check current patch state:
- For each affected device, verify the installed Windows update/hotfix state against Microsoft’s guidance for CVE-2017-8635.
- Use the official advisory as the source of truth for what exact update(s) are required on each Windows version.
Apply the fix:
- Install Microsoft’s recommended remediation for CVE-2017-8635 on all affected machines.
- After installing, reboot if required and confirm the update is present.
If patching is delayed (temporary risk reduction):
- Treat this as “user-click triggered.” Immediately reinforce policies: block/flag unknown links, discourage opening unexpected files, and use browser protections (as available in your environment).
What to monitor after remediation:
- Watch for endpoint indicators associated with malicious script execution (e.g., unusual process launches shortly after browser activity).
- Ensure logs/alerts are reviewed for suspicious browser-originated activity.

Technical context

CVE-2017-8635 is classified under CWE-119 (memory corruption). The findings indicate a JavaScript engine weakness where handling objects in memory can corrupt data and enable arbitrary code execution in the current user context. The attack requires network delivery of a malicious website or crafted file and requires user interaction (opening/loading the malicious content); no authentication is required by the attacker. Exploitation readiness: a public exploit is available, which increases real-world risk; however, this CVE was not found in the CISA KEV list in the provided findings. Attack likelihood was predicted (EPSS) but that prediction should not be used as the deciding factor—public exploit availability and active interest/press attention were noted in the findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

56% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

A public exploit existed 67 days before the patch.

2026-09-23EPSS band changemoderate → highepss band change
2026-09-21EPSS band changehigh → moderateepss band change
2026-09-06EPSS band changemoderate → highepss band change
2026-09-05EPSS band changehigh → moderateepss band change
2026-08-31EPSS band changemoderate → highepss band change
2026-08-29EPSS band changehigh → moderate

Affected products

Microsoft Corpcommercial · USaka microsoft, microsoft corporation
- Internet ExplorerDesktop AppOn-premConsumer Software / browser
- Microsoft EdgeDesktop AppOn-premConsumer Software / browser
Microsoft Corporationcommercial · USaka microsoft
- Microsoft Scripting EngineOn-premOperating Systems / windows

And 2 more affected products. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable