CVE-2021-27059: 
vulnerability analysis and mitigation

Microsoft Office Remote Code Execution Vulnerability (CVE-2021-27059) was disclosed on March 9, 2021. This security vulnerability affects multiple versions of Microsoft Office, including Office 2010 SP2, Office 2013 SP1, and Office 2016 (NVD).

The vulnerability has received multiple CVSS severity ratings. According to the National Vulnerability Database, it has a CVSS 3.1 Base Score of 6.5 (MEDIUM) with vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, while Microsoft assessed it with a higher CVSS 3.1 Base Score of 7.6 (HIGH) with vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute remote code on the affected system with the same privileges as the compromised user, potentially leading to full system compromise with high impacts on confidentiality, integrity, and availability (NVD).

The vulnerability has been added to CISA's Known Exploited Vulnerabilities Catalog on November 3, 2021, indicating that it has been actively exploited in the wild (NVD).

Microsoft has released security updates to address this vulnerability. Organizations are advised to apply the vendor updates according to Microsoft's security advisory. For Office 2016, the security update KB4493225 has been released to resolve this vulnerability (Microsoft Support).