"We've seen isolated exploitation of this issue in the wild," Mehta said. "People need to realize the exploit code works very well," and they should patch their systems as soon as possible, he said.

The availability of the exploit last month had some security analysts predicting that Microsoft would release an out-of-cyle patch.

'I feel they held off giving us an emergency patch because they knew they were releasing a cumulative IE update anyway,' said Russ Cooper, editor of the NTBugtraq mailing list and a senior scientist at Cybertrust Inc. in Herndon, Va.

By waiting, the company missed an opportunity to show that its out-of-cycle release methods are still working well, Cooper said. 'That said, it is understandable, I believe, to the security community that the active threat was not prevelant enough to warrant the emergency push."