CVE-2017-0199

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."

Exploited in the wild: Yesadded 2021-11-03 · due 2022-05-03 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast: 99%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · HIGH: 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Internet exposure: not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

not checked

Not checked yet. Our exploit watch has not looked at this CVE, so this says nothing either way.

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Tied by cited sources to

MuddyWater
1. “Clearsky has detected new and advanced attack vector used by MuddyWater to target governmental entities and the telecommunication sector. Notably, the TTP includes decoy documents exploiting CVE-2017-0199 as the first stage of the attack.”
  cited as exploiting · source: clearskysec.com ↗ · 2026-10-17
2. “MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
Cobalt
1. “Microsoft Word Intruder Integrates CVE-2017-0199, Utilized by Cobalt Group to Target Financial Institutions”
  cited as exploiting · source: proofpoint.com ↗ · 2026-10-17
2. “Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
3. “This adversary incorporated CVE-2017-0199, CVE- 2017-8759 and CVE-2017-11882 into their spear- phishing operations shortly after zero-day.”
  cited as exploiting · named nearby · source: go.crowdstrike.com ↗ · 2026-10-17
The Gorgon Group
1. “This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 .”
  cited as exploiting · source: unit42.paloaltonetworks.com ↗ · 2026-10-17
2. “This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 .”
  cited as exploiting · source: researchcenter.paloaltonetworks.com ↗ · 2026-10-17
MUSTANG PANDA
1. “The June 2018 adversary spotlight is on MUSTANG PANDA, a China-based adversary that has demonstrated an ability to rapidly assimilate new tools and tactics into its operations , as evidenced by its use of exploit code for CVE-2017-0199 within days of its public disclosure.”
  cited as exploiting · source: crowdstrike.com ↗ · 2026-10-17
2. “Mustang Panda has exploited CVE-2017-0199 in Microsoft Word to execute code.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
APT41
1. “APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
BlackTech
1. “BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
TA459
1. “TA459 has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
2. “This time, however, attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan (RAT).”
  cited as exploiting · named nearby · source: proofpoint.com ↗ · 2026-10-17
APT37
1. “APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
2. “This document exploited a newer vulnerability, CVE-2017-0199. Group 123 used this vulnerability less than one month after its public disclosure.”
  cited as exploiting · source: blog.talosintelligence.com ↗ · 2026-10-17
3. “This document exploited a newer vulnerability, CVE-2017-0199. Group 123 used this vulnerability less than one month after its public disclosure.”
  cited as exploiting · source: blog.talosintelligence.com ↗ · 2026-10-17
RevengeHotels
1. “The main attack vector is via email with crafted Word, Excel or PDF documents attached. Some of them exploit CVE-2017-0199, loading it using VBS and PowerShell scripts and then installing customized versions of RevengeRAT, NjRAT, NanoCoreRAT, 888 RAT and other custom malware such as ProCC in the victim’s machine.”
  cited as used in a campaign · named nearby · source: securelist.com ↗ · 2026-10-17
OilRig
1. “OilRig exploiting CVE-2017-0199 in new campaign”
  cited as exploiting · source: securelist.com ↗ · 2026-10-17
2. “The fileless attack was delivered via Microsoft Word documents that exploited a former zero-day vulnerability in Word, CVE-2017-0199, to install a fileless attack variant of the Helminth Trojan agent.”
  cited as exploiting · named nearby · source: blog.morphisec.com ↗ · 2026-10-17
3. “Issue.dot is a file that attempts to exploit CVE-2017-0199 Microsoft Word Office/WordPad Remote Code Execution Vulnerability using the following code:”
  cited as exploiting · named nearby · source: unit42.paloaltonetworks.com ↗ · 2026-10-17

Each actor is cited by the quoted source, linked under the quote. A citation is that source's claim, not our confirmation.

References

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

Signals

Exploits

On the wire

Watch this one?