ACTIVELY EXPLOITED
CVE-2024-7262: Kingsoft WPS Office Path Traversal Vulnerability
| Vendor | Kingsoft |
|---|---|
| Product | WPS Office |
| Actively exploited | Yes |
| Added to CISA KEV | 3 Sep 2024 |
| CISA federal deadline | 24 Sep 2024 |
| Weakness (CWE) | CWE-22 |
Required action (CISA's text)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description (NVD)
Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library.
SOURCES
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.