Hazard

Is CVE-2014-6332 being exploited?

Weaponised and widely attempted

Reliable public exploit code exists, or mass exploitation attempts are probable. Patch inside days, not weeks.

Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability

Microsoft · Windows

CVSS 8.8 EPSS 95% 9 public exploits Fix deadline passed 15 April 2022

What it is

OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site.

Why we say that

  • EPSS puts exploitation in the next 30 days at 95%
  • 9 public exploits published
  • CISA's federal remediation deadline (2022-04-15) has passed
  • Listed in the CISA Known Exploited Vulnerabilities catalogue

Every line above comes from a named public source. Where the evidence is thin, we say so rather than inventing confidence — see methodology.

What to do

Apply updates per vendor instructions.

Public exploit code

Indexed from Exploit-DB. Presence of code raises urgency; absence does not mean safety.

What it costs when this goes wrong

This is where UK enforcement meets the vulnerability record. Where an unfixed vulnerability leads to a breach, the ICO treats it as a security failure under UK GDPR. Recent cases:

All UK cases caused by unpatched software →