CVE-2018-0840

A harmful webpage can exploit a mistake in how the browser handles information and potentially run unwanted software on a staff computer. Think of it as a forged key that only works after someone uses it to open a bad website, but can then unlock the office computer for an intruder.

This matters to you if you use or run Internet Explorer on the affected older Windows versions. An attacker would need to get someone to open malicious web content; there is no indication in the findings that an attacker needs an existing login.

Public exploit code is available, so this deserves prompt scheduling and verification. It is not listed in CISA's catalog of vulnerabilities known to be actively exploited, which supports an amber—not emergency—priority.

Confirm exposure by inventorying endpoints and servers for Internet Explorer on the Windows releases named in the advisory, then verify their installed Microsoft security updates. Deploy the vendor remediation through your established Windows update or endpoint-management process; the supplied findings do not identify fixed build numbers for individual Windows branches. Test the update on representative systems before broad deployment if business-critical legacy applications depend on Internet Explorer. If patching is delayed, prevent Internet Explorer from accessing untrusted sites and move users to a supported browser where practical. No CISA KEV due date applies because this CVE is not listed in KEV. Monitor update-deployment status and investigate unexpected browser crashes or suspicious activity on unpatched devices.

Severity is CVSS 7.5 (High): AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness is CWE-787, an out-of-bounds write/memory-corruption issue in the scripting engine, with remote code execution possible after user interaction. One public exploit is known. CISA KEV does not list this CVE. EPSS predicts 48.2% likelihood (99th percentile) and is falling; this is a prediction, not evidence of active exploitation.