Hazard

Is CVE-2021-27852 being exploited?

Confirmed exploited in the wild

CISA has evidence of active exploitation. This is not theoretical risk — someone has already used it against someone.

Checkbox Survey Deserialization of Untrusted Data Vulnerability

Checkbox · Checkbox Survey

CVSS 9.8 EPSS 32% no public exploit indexed Fix deadline passed 2 May 2022

What it is

Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.

Why we say that

  • CISA's federal remediation deadline (2022-05-02) has passed
  • CVSS 9.8 critical
  • Listed in the CISA Known Exploited Vulnerabilities catalogue

Every line above comes from a named public source. Where the evidence is thin, we say so rather than inventing confidence — see methodology.

What to do

Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.

What it costs when this goes wrong

This is where UK enforcement meets the vulnerability record. Where an unfixed vulnerability leads to a breach, the ICO treats it as a security failure under UK GDPR. Recent cases:

All UK cases caused by unpatched software →