Fix CVE-2021-43905 Still Reported on Updated Microsoft 365 Apps
Question details
Users are receiving persistent CVE-2021-43905 vulnerability reports from their security scanners, even after installing the latest Microsoft 365 Apps security updates.
- Product
- Microsoft 365 Apps
- Device & OS
- not provided
- Scenario
- Running a routine vulnerability scan on devices with Microsoft 365 installed.
- Observed behavior
- The vulnerability scanner falsely flags the system as vulnerable to CVE-2021-43905, typically due to leftover installation files, despite the active applications being fully patched.
Ensure you have administrative privileges to verify Office updates and access to your vulnerability scanner's detection logs.
Manually Verify and Update Microsoft 365 Apps
Ensure your Microsoft 365 Apps have successfully applied the December 2021 or newer security updates to patch the vulnerability.
Launch any Microsoft Office application, such as Excel or Word.
Click on 'File' in the top-left corner, select 'Account' from the sidebar, and locate the 'Product Information' section.
Click on 'Update Options' and select 'Update Now' from the drop-down menu.
Allow the update process to finish. If prompted, restart the Office application to apply the changes.
Report False Positives to Your Scanner Vendor
If updates are verified but the vulnerability is still reported, address the false positive with your scanner's vendor.
Switch to WPS Office for a Secure, Lightweight Experience
If managing bulky Microsoft Office installations and dealing with false positive vulnerability scans is frustrating, consider switching to WPS Office. It provides a secure, streamlined, and highly compatible alternative without the heavy footprint of leftover installation files.
- 1. Download WPS Office: Visit the official WPS website and download the free installer for your operating system.
- 2. Install the Software: Run the lightweight installer, which sets up the suite quickly without leaving massive cache files.
- 3. Open Your Office Files: Directly open your existing .xlsx, .docx, and .pptx files in WPS Office with full format compatibility.
Frequently Asked Questions
Why does my scanner still flag CVE-2021-43905 after updating Office?
Scanners often flag dormant default Microsoft 365 installation files left on your local drive. As long as your active applications are fully updated with the latest security patches, these inactive cache files do not pose a real security risk.
When was the CVE-2021-43905 vulnerability patched?
Microsoft addressed this specific vulnerability, which primarily affected Excel, in the December 2021 security updates. Any Office version updated after this date is secure against this exploit.
Should I manually delete the default Microsoft 365 installation files?
While deleting them might stop the false alerts from your scanner, it can sometimes interfere with Office repair processes. It is generally safer to contact your scanner vendor to update their detection logic.
