{"metadata": {"vulnerability": "CVE-2021-38646", "count": 49, "kinds": {"milestone": 5, "sighting": 15, "kev": 11, "other": 18}, "linked_omitted": 0}, "data": [{"timestamp": "2021-08-13T00:00:00Z", "date_only": false, "value": "2021-08-13T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2021-38646", "field": "cveMetadata.dateReserved"}, {"timestamp": "2021-09-14T14:00:00Z", "date_only": false, "value": "2021-09-14T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2021-38646", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2021-09-15T11:24:06Z", "date_only": false, "value": "2021-09-15T11:24:06.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-38646", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2021-09-15T12:15:00Z", "date_only": false, "value": "2021-09-15T12:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-846X-H43V-68X9", "record": "GHSA-846X-H43V-68X9", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2021-09-15T12:15:15.033Z", "date_only": false, "value": "2021-09-15T12:15:15.033", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-38646", "record": "FKIE_CVE-2021-38646", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2021-09-15T12:15:15.033Z", "date_only": false, "value": "2021-09-15T12:15:15.033", "kind": "milestone", "label": "Published", "source": "gsd \u00b7 GSD-2021-38646", "record": "GSD-2021-38646", "field": "namespaces.nvd.nist.gov.cve.published", "linked_record": true}, {"timestamp": "2021-09-16T00:00:00Z", "date_only": false, "value": "2021-09-16T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2021-AVI-709", "record": "CERTFR-2021-AVI-709", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2021-09-16T00:00:00Z", "date_only": false, "value": "2021-09-16T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2021-AVI-711", "record": "CERTFR-2021-AVI-711", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2021-10-24T07:35:33Z", "date_only": false, "value": "2021-10-24T07:35:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cKure/7741", "record": "CVE-2021-38646", "field": "creation_timestamp", "uuid": "88b59760-7d9d-4aac-be2b-55b934e362ee", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Code Execution in Microsoft Office (CVE-2021-38646)\n\nhttps://spaceraccoon.dev/all-your-d-base-are-belong-to-us-part-2-code-execution-in-microsoft-office", "url": "https://t.me/cKure/7741", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2021-10-25T22:32:43Z", "date_only": false, "value": "2021-10-25T22:32:43.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/63ddead6-4b82-414c-ad8e-c516b950b446", "record": "CVE-2021-38646", "field": "creation_timestamp", "uuid": "31550b47-689b-41d2-bda7-80e6786def43"}, {"timestamp": "2021-10-30T14:25:18Z", "date_only": false, "value": "2021-10-30T14:25:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/4632", "record": "CVE-2021-38646", "field": "creation_timestamp", "uuid": "c5f78299-ec63-4390-a831-a73e63314f31", "content": "#exploit\nCVE-2021-38646:\n1. Code Execution in Microsoft Office\nhttps://medium.com/csg-govtech/all-your-d-base-are-belong-to-us-part-2-code-execution-in-microsoft-office-cve-2021-38646-fa6e70362162\n\n2. Windows User Profile Service 0day LPE\nhttps://github.com/klinix5/ProfSvcLPE/blob/main/write-up.docx\n]-> PoC: https://github.com/klinix5/ProfSvcLPE/tree/main/DoubleJunctionEoP", "url": "https://t.me/CyberSecurityTechnologies/4632", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-38646", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "336c2a6b-7714-497e-ab1f-9b677e40341e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2021-38646", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "cbd3ed60-0306-44ee-85f2-a97eeb03e0ec", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": true, "value": "2022-03-28", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-38646", "field": "containers.adp.1.metrics.1.other.content.dateAdded"}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": true, "value": "2022-03-28", "kind": "other", "label": "Catalog added", "source": "gsd \u00b7 GSD-2021-38646", "record": "GSD-2021-38646", "field": "namespaces.cisa.gov.dateAdded", "linked_record": true}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2021-38646", "field": "evidence.0.details.added_date", "uuid": "cbd3ed60-0306-44ee-85f2-a97eeb03e0ec", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": true, "value": "2022-03-28", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2021-38646", "field": "evidence.0.details.date_added", "uuid": "336c2a6b-7714-497e-ab1f-9b677e40341e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2021-38646", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "336c2a6b-7714-497e-ab1f-9b677e40341e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2021-38646", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "cbd3ed60-0306-44ee-85f2-a97eeb03e0ec", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2021-38646", "field": "status.status_updated_at", "uuid": "336c2a6b-7714-497e-ab1f-9b677e40341e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2021-38646", "field": "status.status_updated_at", "uuid": "cbd3ed60-0306-44ee-85f2-a97eeb03e0ec", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-38646", "field": "containers.adp.1.timeline.0.time", "text": "CVE-2021-38646 added to CISA KEV"}, {"timestamp": "2022-04-18T00:00:00Z", "date_only": true, "value": "2022-04-18", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2021-38646", "field": "evidence.0.details.due_date", "uuid": "336c2a6b-7714-497e-ab1f-9b677e40341e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-04-18T00:00:00Z", "date_only": true, "value": "2022-04-18", "kind": "other", "label": "Remediation due", "source": "gsd \u00b7 GSD-2021-38646", "record": "GSD-2021-38646", "field": "namespaces.cisa.gov.dueDate", "linked_record": true}, {"timestamp": "2022-05-24T19:14:43Z", "date_only": false, "value": "2022-05-24T19:14:43Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-846X-H43V-68X9", "record": "GHSA-846X-H43V-68X9", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2023-06-14T21:10:04Z", "date_only": false, "value": "2023-06-14T21:10:04.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2021-38646", "field": "creation_timestamp", "uuid": "ddd99e50-d3d5-4694-852a-f685d992d02f"}, {"timestamp": "2023-12-04T20:46:02Z", "date_only": false, "value": "2023-12-04T20:46:02.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/1301", "record": "CVE-2021-38646", "field": "creation_timestamp", "uuid": "cae2cdbb-2a32-4c6c-a6f7-c09edf1e3dac", "content": "#ExploitObserverAlert\n\nCVE-2021-38646\n\nDESCRIPTION: Exploit Observer has 5 entries related to CVE-2021-38646. Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability\n\nFIRST-EPSS: 0.012750000\nNVD-IS: 5.9\nNVD-ES: 1.8", "url": "https://t.me/arpsyndicate/1301"}, {"timestamp": "2023-12-13T01:23:17.230Z", "date_only": false, "value": "2023-12-13T01:23:17.230577Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-38646", "record": "GSD-2021-38646", "field": "gsd.osvSchema.modified", "linked_record": true}, {"timestamp": "2023-12-28T20:16:02.703Z", "date_only": false, "value": "2023-12-28T20:16:02.703", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-38646", "record": "GSD-2021-38646", "field": "namespaces.nvd.nist.gov.cve.lastModified", "linked_record": true}, {"timestamp": "2024-08-04T01:51:18.926Z", "date_only": false, "value": "2024-08-04T01:51:18.926Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2021-38646", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-12-24T20:29:59.327Z", "date_only": false, "value": "2024-12-24T20:29:59.327474Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971484", "record": "CVE-2021-38646", "field": "creation_timestamp", "uuid": "9a3b6d1c-670d-4c0b-baf2-ea308a9bfd5d", "url": "https://feedsin.space/feed/CISAKevBot/items/2971484"}, {"timestamp": "2025-02-04T18:11:37.868Z", "date_only": false, "value": "2025-02-04T18:11:37.868401Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-38646", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2025-02-04T18:11:37.868Z", "date_only": false, "value": "2025-02-04T18:11:37.868401Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-38646", "record": "FKIE_CVE-2021-38646", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2025-02-23T02:10:31Z", "date_only": false, "value": "2025-02-23T02:10:31.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2021-38646", "field": "creation_timestamp", "uuid": "b5f68185-70db-4de6-8604-3be639184fab"}, {"timestamp": "2025-10-21T23:25:33.296Z", "date_only": false, "value": "2025-10-21T23:25:33.296Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-38646", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-02-02T12:27:55.234Z", "date_only": false, "value": "2026-02-02T12:27:55.234427Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/336c2a6b-7714-497e-ab1f-9b677e40341e", "record": "CVE-2021-38646", "field": "creation_timestamp", "uuid": "85fa98c6-39a0-4156-8f15-780459409377", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/336c2a6b-7714-497e-ab1f-9b677e40341e", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-19T12:47:21.001Z", "date_only": false, "value": "2026-06-19T12:47:21.001582Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/62a96021-79fd-4fd1-87f1-5f796f5eb18b", "record": "CVE-2021-38646", "field": "creation_timestamp", "uuid": "527fb2dd-5a1f-429c-a165-e307bbe6b42c", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/62a96021-79fd-4fd1-87f1-5f796f5eb18b", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2021-38646", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "cbd3ed60-0306-44ee-85f2-a97eeb03e0ec", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:05:16.233Z", "date_only": false, "value": "2026-06-23T14:05:16.233063Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cbd3ed60-0306-44ee-85f2-a97eeb03e0ec", "record": "CVE-2021-38646", "field": "creation_timestamp", "uuid": "e9411e69-11ff-4c2a-aed7-f9b199bdfbd6", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cbd3ed60-0306-44ee-85f2-a97eeb03e0ec", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-29T12:02:52.135Z", "date_only": false, "value": "2026-07-29T12:02:52.135802Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/1727", "record": "CVE-2021-38646", "field": "creation_timestamp", "uuid": "59bee03b-99fc-403f-a28b-41636b6c06e9", "content": "All Your (d)Base Are Belong To Us, Part 2: Code Execution in Microsoft Office (CVE-2021\u201338646) https://medium.com/csg-govtech/all-your-d-base-are-belong-to-us-part-2-code-execution-in-microsoft-office-cve-2021-38646-fa6e70362162", "url": "https://t.me/reverseame/1727"}, {"timestamp": "2026-08-03T05:00:04.543Z", "date_only": false, "value": "2026-08-03T05:00:04.543454Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/reverseame/1727", "record": "CVE-2021-38646", "field": "creation_timestamp", "uuid": "51895b47-9c03-4635-932c-83f2ce8b1000", "content": "All Your (d)Base Are Belong To Us, Part 2: Code Execution in Microsoft Office (CVE-2021\u201338646) https://medium.com/csg-govtech/all-your-d-base-are-belong-to-us-part-2-code-execution-in-microsoft-office-cve-2021-38646-fa6e70362162", "url": "https://t.me/reverseame/1727", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-10T15:11:01.156Z", "date_only": false, "value": "2026-08-10T15:11:01.156Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2021-38646", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-10T15:11:01.156Z", "date_only": false, "value": "2026-08-10T15:11:01.156Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "CVE-2021-38646", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-10T18:31:10Z", "date_only": false, "value": "2026-08-10T18:31:10Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-846X-H43V-68X9", "record": "GHSA-846X-H43V-68X9", "field": "modified", "linked_record": true}, {"timestamp": "2026-08-10T19:59:12.030Z", "date_only": false, "value": "2026-08-10T19:59:12.030", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-38646", "record": "FKIE_CVE-2021-38646", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-08-11T18:07:10.576Z", "date_only": false, "value": "2026-08-11T18:07:10.576731Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mst7fijdfw2z", "record": "CVE-2021-38646", "field": "creation_timestamp", "uuid": "4c61ff82-09a3-4c3b-b55c-056d43666a9b", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2021-38646: Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability\nCVSS 7.8 \u00b7 EPSS 8.0% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2021-38646\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3mst7fijdfw2z"}, {"timestamp": "2026-09-01T17:00:37.068Z", "date_only": false, "value": "2026-09-01T17:00:37.068340Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/4702", "record": "CVE-2021-38646", "field": "creation_timestamp", "uuid": "ac2bca4e-134b-4b91-9411-99774366924d", "content": "Europol has arrested 12 hackers believed to be behind the LockerGoga, MegaCortex and Dharma ransomware attacks, which targeted large companies and critical infrastructure with over 1,800 victims in 71 countries\nRead: \nhttps://thehackernews.com/2021/10/police-arrest-suspected-ransomware.html\n\nCloud Security\nSnowcat: World\u2019s First Dedicated Security Scanner for Istio\ud83d\ude03\nhttps://www.praetorian.com/blog/introducing-snowcat\n]-> https://github.com/praetorian-inc/snowcat\n\nRed Team Tactics\nUnderstanding SysCalls Manipulation\nhttps://redteaming.co.uk/2021/10/28/understanding-syscalls\n\nexploit\nCVE-2021-38646:\n1. Code Execution in Microsoft Office\nhttps://medium.com/csg-govtech/all-your-d-base-are-belong-to-us-part-2-code-execution-in-microsoft-office-cve-2021-38646-fa6e70362162\n\n2. Windows User Profile Service 0day LPE\nhttps://github.com/klinix5/ProfSvcLPE/blob/main/write-up.docx\n]-> PoC: https://github.com/klinix5/ProfSvcLPE/tree/main/DoubleJunctionEoP\n\nThreat Research\n1. Atlassian Bug Bounty: XSS stored in api-media-atlassian-com via MS Office Doc file (iOS)\nhttps://omespino.com/write-up-xss-stored-in-api-media-atlassian-com-via-doc-file-ios\n2. 50 Shades of SolarWinds Orion Deserialization (CVE-2021-35218)\nhttps://testbnull.medium.com/50-shades-of-solarwinds-orion-patch-manager-deserialization-final-part-cve-2021-35218-3d38166cb81f", "url": "https://t.me/cissp/4702"}, {"timestamp": "2026-09-10T16:00:05.279Z", "date_only": false, "value": "2026-09-10T16:00:05.279977Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cissp/4702", "record": "CVE-2021-38646", "field": "creation_timestamp", "uuid": "2f49e096-42c8-423f-9aea-2788a10c78e1", "content": "Europol has arrested 12 hackers believed to be behind the LockerGoga, MegaCortex and Dharma ransomware attacks, which targeted large companies and critical infrastructure with over 1,800 victims in 71 countries\nRead: \nhttps://thehackernews.com/2021/10/police-arrest-suspected-ransomware.html\n\nCloud Security\nSnowcat: World\u2019s First Dedicated Security Scanner for Istio\ud83d\ude03\nhttps://www.praetorian.com/blog/introducing-snowcat\n]-> https://github.com/praetorian-inc/snowcat\n\nRed Team Tactics\nUnderstanding SysCalls Manipulation\nhttps://redteaming.co.uk/2021/10/28/understanding-syscalls\n\nexploit\nCVE-2021-38646:\n1. Code Execution in Microsoft Office\nhttps://medium.com/csg-govtech/all-your-d-base-are-belong-to-us-part-2-code-execution-in-microsoft-office-cve-2021-38646-fa6e70362162\n\n2. Windows User Profile Service 0day LPE\nhttps://github.com/klinix5/ProfSvcLPE/blob/main/write-up.docx\n]-> PoC: https://github.com/klinix5/ProfSvcLPE/tree/main/DoubleJunctionEoP\n\nThreat Research\n1. Atlassian Bug Bounty: XSS stored in api-media-atlassian-com via MS Office Doc file (iOS)\nhttps://omespino.com/write-up-xss-stored-in-api-media-atlassian-com-via-doc-file-ios\n2. 50 Shades of SolarWinds Orion Deserialization (CVE-2021-35218)\nhttps://testbnull.medium.com/50-shades-of-solarwinds-orion-patch-manager-deserialization-final-part-cve-2021-35218-3d38166cb81f", "url": "https://t.me/cissp/4702", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-04T13:31:51Z", "date_only": false, "value": "2026-11-04T13:31:51+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2021-38646", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "336c2a6b-7714-497e-ab1f-9b677e40341e", "status": {"status_reason": "confirmed", "exploited": true}}], "metrics": {"as_of": "2026-11-14T17:16:24.568Z", "anchors": {"origin": {"timestamp": "2021-09-14T14:00:00Z", "date_only": false, "value": "2021-09-14T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2021-38646", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2021-09-14T14:00:00Z", "date_only": false, "value": "2021-09-14T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2021-38646", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2021-10-24T07:35:33Z", "date_only": false, "value": "2021-10-24T07:35:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cKure/7741", "record": "CVE-2021-38646", "field": "creation_timestamp", "uuid": "88b59760-7d9d-4aac-be2b-55b934e362ee", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Code Execution in Microsoft Office (CVE-2021-38646)\n\nhttps://spaceraccoon.dev/all-your-d-base-are-belong-to-us-part-2-code-execution-in-microsoft-office", "url": "https://t.me/cKure/7741", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-38646", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "336c2a6b-7714-497e-ab1f-9b677e40341e", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 16797600.0, "hours": 4666.0, "days": 194.41666666666666, "min_seconds": 16797600.0, "max_seconds": 16884000.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": true, "end_before_start": false, "start": {"timestamp": "2021-09-14T14:00:00Z", "date_only": false, "value": "2021-09-14T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2021-38646", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-38646", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "336c2a6b-7714-497e-ab1f-9b677e40341e", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 16797600.0, "hours": 4666.0, "days": 194.41666666666666, "min_seconds": 16797600.0, "max_seconds": 16884000.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": true, "end_before_start": false, "start": {"timestamp": "2021-09-14T14:00:00Z", "date_only": false, "value": "2021-09-14T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2021-38646", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-38646", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "336c2a6b-7714-497e-ab1f-9b677e40341e", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 3432933.0, "hours": 953.5925, "days": 39.733020833333335, "min_seconds": 3432933.0, "max_seconds": 3432933.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-09-14T14:00:00Z", "date_only": false, "value": "2021-09-14T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2021-38646", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2021-10-24T07:35:33Z", "date_only": false, "value": "2021-10-24T07:35:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cKure/7741", "record": "CVE-2021-38646", "field": "creation_timestamp", "uuid": "88b59760-7d9d-4aac-be2b-55b934e362ee", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Code Execution in Microsoft Office (CVE-2021-38646)\n\nhttps://spaceraccoon.dev/all-your-d-base-are-belong-to-us-part-2-code-execution-in-microsoft-office", "url": "https://t.me/cKure/7741", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 163048584.568673, "hours": 45291.27349129806, "days": 1887.1363954707524, "min_seconds": 163048584.568673, "max_seconds": 163048584.568673, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-09-14T14:00:00Z", "date_only": false, "value": "2021-09-14T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2021-38646", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T17:16:24.568Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 146250984.568673, "hours": 40625.27349129806, "days": 1692.719728804086, "min_seconds": 146164584.568673, "max_seconds": 146250984.568673, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": true, "end_before_start": false, "start": {"timestamp": "2022-03-28T00:00:00Z", "date_only": false, "value": "2022-03-28T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-38646", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "336c2a6b-7714-497e-ab1f-9b677e40341e", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-11-14T17:16:24.568Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 159615651.568673, "hours": 44337.68099129806, "days": 1847.4033746374191, "min_seconds": 159615651.568673, "max_seconds": 159615651.568673, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-10-24T07:35:33Z", "date_only": false, "value": "2021-10-24T07:35:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cKure/7741", "record": "CVE-2021-38646", "field": "creation_timestamp", "uuid": "88b59760-7d9d-4aac-be2b-55b934e362ee", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Code Execution in Microsoft Office (CVE-2021-38646)\n\nhttps://spaceraccoon.dev/all-your-d-base-are-belong-to-us-part-2-code-execution-in-microsoft-office", "url": "https://t.me/cKure/7741", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-14T17:16:24.568Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}