Patchwork · vendor

Microsoft

6 CVEs · 6 in CISA KEV

Every dot is a CVE a source says this actor exploits; each name says which source. The named ones are the most at risk.

Open Patchwork's actor page

exploited in the wild: 6

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code…CVE-2017-11882Microsoft Corporation · CVSS 7.8 · 100% likely · ATT&CK T1203
CWE-119 Microsoft APT41 Bitter
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Window…CVE-2017-0199Microsoft Corporation · CVSS 7.8 · 99% likely · ATT&CK T1203
Microsoft APT37 APT41
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint…CVE-2015-1641Microsoft · CVSS 7.8 · 97% likely · ATT&CK T1203
CWE-787 Microsoft APT41 Confucius
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CV…CVE-2017-8570Microsoft Corporation · CVSS 7.8 · 90% likely · ATT&CK T1203
Microsoft Cobalt Group
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote a…CVE-2014-4114Microsoft · CVSS 7.8 · 82% likely · ATT&CK T1203
Microsoft BRONZE BUTLER
The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Ser…CVE-2012-1856Microsoft · CVSS 8.8 · 72% likely · ATT&CK T1203
Microsoft

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.