Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2017-0199 | 7.8 | 99.9% | ✅ listed | available | 77.5 (High) |
| CVE-2017-11882 | 7.8 | 100.0% | ✅ listed | available | 75.5 (High) |
Dr.Web Q2 2026: +5.72% detections, +95.32% unique threats
Dr.Web’s Q2 2026 report shows total detections up 5.72% quarter-over-quarter, with unique threats jumping 95.32% QoQ. The spike is driven by a wave of encoder trojans and a MAX-messenger phishing campaign that has been active since late April.
The workhorse for the new wave is CVE-2017-11882, a 2017 Microsoft Office vulnerability that scores CVSS 7.8 (v3.1) and sits at EPSS 100.0% (100th percentile). It is in CISA’s KEV list and has a public PoC. The PRS risk score is 75.5 (High). The bug lives in the Office equation editor and lets an attacker run arbitrary code in the current user’s context by failing to properly handle objects in memory. It affects Office 2007 SP3 through Office 2016.
The CVE-2017-11882 flaw: Office equation editor RCE
The flaw sits in the Office equation editor, where a failure to properly handle objects in memory lets an attacker run arbitrary code in the current user’s context. It affects Microsoft Office 2007 Service Pack 3 through Office 2016, spanning the four most widely deployed Office versions in enterprise environments.
Severity is consistent across the board: CVSS 7.8 (v3.1), EPSS 100.0% at the 100th percentile, CISA KEV listed, and a public PoC. The PRS risk score lands at 75.5, rated High. That combination — high CVSS, maxed-out EPSS, KEV, and a working PoC — is what keeps it in active maldoc rotation years after the 2017 disclosure.
How the MAX-messenger phishing wave uses it
The lures are Office documents — typically Word or RTF — tagged with CVE-2017-11882 (and CVE-2017-0199 for the older variant). When the victim opens the file, the equation editor RCE fires and drops the payload. ESET’s H2 2023 LATAM report confirms the same pattern: the exploit is the top maldoc detection, and it’s used to stage Agent Tesla, ransomware, and crypto miners.
VirusTotal’s hunting rule filters on three things: the CVE tag in vt.metadata.tags, the submitter country (PK, LK, BD), and the file type (Word, RTF, or MS-Office). That’s how they pulled the samples from VT and matched them to the campaign’s operational profile.
Who was hit: South Asia and LATAM
The campaign’s geographic footprint is tight. VirusTotal’s hunting rule filters on three fields: the CVE tag in vt.metadata.tags, the submitter country, and the file type. The country list is PK, LK, and BD — Pakistan, Sri Lanka, and Bangladesh. The file type is Word, RTF, or MS-Office. That’s the operational profile for the maldocs.
China is deliberately excluded from the country filter. The team removed CN because bulk submissions of related maldocs from Chinese submitters were flooding the results with noise that didn’t match the campaign’s submission pattern. Without the exclusion, the rule would have pulled in a large volume of unrelated files from the same CVE tags.
ESET’s H2 2023 LATAM report confirms the same exploit as the top malicious email detection in the region. The detection name is Win/Exploit.CVE-2017-11882 trojan. It stages Agent Tesla, ransomware, and crypto miners behind the Office document. The same pattern is still active in Q2 2026, which is what keeps it in rotation despite the 2017 age.
Key points
- Total detections up 5.72% quarter-over-quarter
- Unique threats up 95.32% quarter-over-quarter
- Encoder trojans lead the top detections
- MAX-messenger phishing wave is the new top campaign
- CVE-2017-11882 (CVSS 7.8, EPSS 100%) remains the primary Office exploit in the mix