Microsoft · Defender

CVE-2021-1647

Microsoft Defender Remote Code Execution Vulnerability

Exploited in attacks High 7.8 Attack chance: 40%

What it is

Microsoft Defender Remote Code Execution Vulnerability

CISA: Microsoft Defender contains an unspecified vulnerability that allows for remote code execution.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: November 17, 2021

msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1647

Added to the CISA list: November 3, 2021
Published: January 12, 2021
Severity: High 7.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 40% in the top 1.4% of all known vulnerabilities
Weakness: CWE-122 CWE-1285
More details: NVD · CVE.org · CISA

More exploited flaws from Microsoft

Added	Vulnerability	Product	Severity	Attack chance
May 20, 2026	Link FollowingCVE-2026-41091	Defender	High 7.8	8.2%
May 20, 2026	Denial of ServiceCVE-2026-45498	Defender	Medium 4.0	63%
Apr 22, 2026	Insufficient Granularity of Access ControlCVE-2026-33825used by ransomware	Defender	High 7.8	6.7%
Dec 13, 2022	SmartScreen Security Feature BypassCVE-2022-44698used by ransomware	Defender	Medium 5.4	76%
Oct 13, 2026	Command InjectionCVE-2026-96951	Windows	High 8.8	9.8%
Sep 25, 2026	Code InjectionCVE-2026-65660	SharePoint	High 8.8	8.2%
Sep 8, 2026	Link FollowingCVE-2026-81963	Windows	High 7.8	0.4%
Sep 8, 2026	Heap-Based Buffer OverflowCVE-2026-85880	Windows	High 7.8	0.4%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.