VulnSocial

CVE-2012-0158Active Exploitation(microsoft / biztalk_server)

MEDIUMCVSS 8.8 · HIGHCISA KEV

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for microsoft biztalk_server systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."

microsoft CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-05-03. Apply updates per vendor instructions.

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-94

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • biztalk_server
  • commerce_server
  • commerce_server_2009
  • office

Threat summary

  • Active exploitation appears in 2 classified signals
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 2 signals
  • Technical details provided in 1 signal
  • Peaked 1d ago at 1 mentions (2026-06-08); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
microsoft
Products
biztalk_servercommerce_servercommerce_server_2009officeoffice_web_componentssql_server_2000sql_server_2005sql_server_2008visual_basicvisual_foxpro

9 versions affected across 10 products

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-08: 1Mentions · 2026-08-22: 1Active Exploitation · 2026-06-08: 1Active Exploitation · 2026-08-22: 1Technical Details · 2026-06-08: 106-0808-22
Signal classification1 categories
Active Exploitation
2100.0%
Referenced assets1 URL
Full discourse2 posts
  • ThreatCluster@threatcluster
    Active Exploitation

    MITRE ATT&CK reports that APT28 has repeatedly exploited Microsoft Office flaws CVE-2012-0158 and CVE-2017-11882 via malicious documents to gain remote code execution on victim systems. https://threatcluster.io/cluster/exploitation-of-client-software-vulnerabilities-and-user-exe-be78ab56

    Post summary

    APT28 is actively exploiting Microsoft Office flaws CVE-2012-0158 and CVE-2017-11882 through malicious documents to achieve remote code execution on targeted systems, indicating real-world exploitation.

    0100062
    317 followersView on X
  • kokumօtօ@__kokumoto
    Active Exploitation

    米国サイバーセキュリティ・社会基盤安全保障庁(CISA)の既知の悪用された脆弱性カタログが更新。以下脆弱性について悪用が確認された。 - CVE-2021-43226 (Windows) - CVE-2020-5135 (SonicOS) - CVE-2012-0158 (Windows) https://t.co/36dA3GHlV2

    Post summary

    CISA confirms real‑world exploitation of CVE-2021-43226, CVE-2020-5135, and CVE-2012-0158.

    00000725
    7.7K followersView on X
CPE platform detail20 entries

20 of 20 entries

PartVendorProductVersionTarget SWTarget HW
Appmicrosoftbiztalk_server2002--
Appmicrosoftcommerce_server2002--
Appmicrosoftcommerce_server2007--
Appmicrosoftcommerce_server_2009---
Appmicrosoftcommerce_server_2009r2--
Appmicrosoftoffice2003--
Appmicrosoftoffice2007--
Appmicrosoftoffice2007--
Appmicrosoftoffice2010-x86
Appmicrosoftoffice2010-x86
Appmicrosoftoffice_web_components2003--
Appmicrosoftsql_server_2000---
Appmicrosoftsql_server_2005---
Appmicrosoftsql_server_2008---
Appmicrosoftsql_server_2008---
Appmicrosoftsql_server_2008r2--
Appmicrosoftsql_server_2008r2--
Appmicrosoftvisual_basic6.0--
Appmicrosoftvisual_foxpro8.0--
Appmicrosoftvisual_foxpro9.0--

Explore more

Back to dashboardmicrosoft CVEsbiztalk_server vulnerabilities