Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, an…

cisa required action Apply updates per vendor instructions.

1. 2014-10-14 0-day patched (Project Zero)
2. 2014-10-14 First public exploit (Metasploit exploit/windows/fileformat/ms14_060_sandworm)
3. 2014-10-15 Published
4. 2022-03-03 Added to CISA KEV
5. 2022-03-24 CISA patch deadline
6. 2025-02-10 CISA SSVC: exploitation active

Added

4 y ago (2022-03-03)

Patch by

2022-03-24 (4 y ago)

Ransomware

Not known

Required action

Apply updates per vendor instructions.

Vendor, product

Microsoft, Windows

CISA name

Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Patched

2014-10-14

Details

project zero tracker

Exploitation

Active, exploited in the wild

Automatable

no

Technical impact

total

Assessed

20 mo ago (2025-02-10)

81.63% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-09).

• Metasploit exploit/windows/fileformat/ms14_060_sandworm MS14-060 Microsoft Windows OLE Package Manager Code Execution metasploit exploit, excellent rank, 2014-10-14
• EDB-35236 Microsoft Windows - OLE Package Manager Code Execution (MS14-064) (Metasploit) local, 2014-11-14
• EDB-35235 Microsoft Windows - OLE Package Manager Code Execution (via Python) (MS14-064) (Metasploit) local, 2014-11-14
• EDB-35216 Microsoft Office 2007/2010 - OLE Arbitrary Command Execution local, 2014-11-12
• EDB-35055 Microsoft Windows - OLE Remote Code Execution 'Sandworm' (MS14-060) remote, 2014-10-25
• EDB-35020 Microsoft Windows - OLE Package Manager Code Execution (MS14-060) (Metasploit) local, 2014-10-20
• EDB-35019 Microsoft Windows - OLE Package Manager SandWorm local, 2014-10-20
• blog.trendmicro.com http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-windows-zero-day-vulnerability-cve-2014-4114-aka-sandworm/ referenced PoC, tagged "exploit" by a source, unverified

• docs.microsoft.com /en-us/security-updates/securitybulletins/2014/ms14-060

  vendor-advisory, patch

• exploit-db.com /exploits/35055

  exploit, third-party-advisory, vdb-entry

• exploit-db.com /exploits/35019

  exploit, third-party-advisory, vdb-entry

• exploit-db.com /exploits/35020

  exploit, third-party-advisory, vdb-entry

• blog.trendmicro.com /trendlabs-security-intelligence/an-analysis-of-windows-zero-day-vulnerability-cve-2014-4114-aka-sandworm/

  exploit

• blogs.technet.com /b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx

  broken-link, vendor-advisory

• isightpartners.com /2014/10/cve-2014-4114/

  broken-link

• secunia.com /advisories/60972

  third-party-advisory, broken-link

• securityfocus.com /bid/70419

  vdb-entry, broken-link, third-party-advisory

• osvdb.org /show/osvdb/113140

  vdb-entry, broken-link

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-4114

  government-resource, us-government-resource

• CVE List CVE-2014-4114
• NVD CVE-2014-4114

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.