Advisories from the Dutch National Cyber Security Centre (NCSC) and vulnerabilities from the Microsoft Security Update Guide, for Exchange, SharePoint, the Office apps, Teams, Entra, Intune, Defender, Power Platform, Copilot and other Microsoft 365 products. Every entry is labelled with its source and links to the original.
Language: Dutch and EnglishNCSC advisories are in Dutch and Microsoft entries in English, as each source publishes them.
About this pageSources: advisories.ncsc.nl (NCSC, advisories about Microsoft 365 products) and the Microsoft Security Update Guide (all Microsoft 365 products: Office apps, Exchange Server, SharePoint, Teams, OneDrive, Entra, Intune, Defender, Purview, Power Platform, Copilot, Skype for Business, Authenticator and Windows 365). Both are updated hourly; Windows is not included. Highest risk = NCSC high likelihood and high impact, or Microsoft exploited, or Critical where you need to update yourself. High risk = NCSC high likelihood or impact, or Microsoft Important. No action needed = Microsoft already fixed it in the cloud. Always check which versions you run. 365Fanatic is not affiliated with NCSC or Microsoft. Last updated: 14 okt 2026 21:27 CEST
196 advisories in the last 30 days (NCSC 5, Microsoft 191), 36 highest risk.
Only:
RSSClick to subscribe
Set filters first, then copy the link. Do not open it in Chrome.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.1 out of 10: high. Microsoft rates it Critical.
Already exploited in the wild.Microsoft reports attacks. Treat the update as a priority.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server Subscription Edition RTM: KB5094139 15.02.2562.043
Microsoft Exchange Server 2019 Cumulative Update 15: KB5094140 15.02.1748.046
Microsoft Exchange Server 2019 Cumulative Update 14: KB5094142 15.02.1544.041
Microsoft Exchange Server 2016 Cumulative Update 23: KB5094144 15.01.2507.069
Microsoft Exchange Server · Elevation of Privilege
Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 8.0 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2019 Cumulative Update 14: KB5121575 15.02.1544.044
Microsoft Exchange Server 2019 Cumulative Update 15: KB5121574 15.02.1748.049
Microsoft Exchange Server Subscription Edition RTM: KB5121573 15.02.2562.046
Microsoft Exchange Server 2016 Cumulative Update 23: KB5121576 15.01.2507.072
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 9.6 out of 10: critical. Microsoft rates it Critical.
No attacks reported yet, but Microsoft expects exploitation to be likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server Subscription Edition RTM: KB5103212 15.02.2562.045
Microsoft Exchange Server 2019 Cumulative Update 15: KB5103213 15.02.1748.048
Microsoft Exchange Server 2019 Cumulative Update 14: KB5103214 15.02.1544.043
Microsoft Exchange Server 2016 Cumulative Update 23: KB5103215 15.01.2507.071
Microsoft Exchange Online · Elevation of Privilege
Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Microsoft Exchange Online · Elevation of Privilege
Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 9.6 out of 10: critical. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Microsoft heeft kwetsbaarheden verholpen in Exchange. Een kwaadwillende kan de kwetsbaarheden misbruiken om zich voor te doen als andere gebruiker, zich verhoogde rechten toe te kennen en willekeurige code uit te voeren met rechten van het proces.
Van de kwetsbaarheid met kenmerk CVE-2026-96940 is eerder al een out-of-band update verschenen, maar is ook opgenomen in deze cumulatieve update.
What does this mean?
NCSC rates the likelihood of abuse as medium and the possible impact as high.
7 vulnerabilities, highest CVSS 8.8. See "Show CVE information" for each CVE.
Affects: Exchange, Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 15, Microsoft Exchange Server Subscription Edition RTM.
What should you do?Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Microsoft Exchange Server · Elevation of Privilege
Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 7.5 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898 15.01.2507.077
Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897 15.02.1544.050
Microsoft Exchange Server Subscription Edition RTM: KB5128895 15.02.2562.056
Microsoft Exchange Server 2019 Cumulative Update 15: KB5128896 15.02.1748.055
Microsoft Exchange Server · Elevation of Privilege
Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898 15.01.2507.077
Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897 15.02.1544.050
Microsoft Exchange Server 2019 Cumulative Update 15: KB5128896 15.02.1748.055
Microsoft Exchange Server Subscription Edition RTM: KB5128895 15.02.2562.056
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 9.3 out of 10: critical. Microsoft rates it Important.
No attacks reported yet, but Microsoft expects exploitation to be likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898 15.01.2507.077
Microsoft Exchange Server 2019 Cumulative Update 15: KB5128896 15.02.1748.055
Microsoft Exchange Server Subscription Edition RTM: KB5128895 15.02.2562.056
Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897 15.02.1544.050
Microsoft heeft out-of-band, vooruitlopend op de maandelijkse update voor oktober, een kwetsbaarheid verholpen in Microsoft Exchange Server. De kwetsbaarheid betreft zwakke autorisatiecontroles binnen Microsoft Exchange Server. Een geauthenticeerde aanvaller kan hierdoor op afstand via het netwerk privileges escaleren. Dit betekent dat een aanvaller met geldige inloggegevens hogere rechten kan verkrijgen dan waarvoor deze geautoriseerd is, wat kan leiden tot ongeautoriseerde administratieve acties binnen de Exchange Server-omgeving.
Voor Exchange Online zijn geen acties vereist. Microsoft heeft hiervoor centraal updates uitgerold. Deze kwetsbaarheid vereist wel actie voor organisaties die Exchange on premise hebben draaien.
What does this mean?
NCSC rates the likelihood of abuse as medium and the possible impact as high.
1 vulnerability, highest CVSS 8.8. See "Show CVE information" for each CVE.
Affects: Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 15, Microsoft Exchange Server Subscription Edition RTM.
What should you do?Microsoft heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Microsoft Exchange Server · Elevation of Privilege
Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported yet, but Microsoft expects exploitation to be likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server Subscription Edition RTM: KB5129955 15.02.2562.053
Microsoft Exchange Server 2016 Cumulative Update 23: KB5129958 15.01.2507.075
Microsoft Exchange Server 2019 Cumulative Update 15: KB5129956 15.02.1748.053
Microsoft Exchange Server 2019 Cumulative Update 14: KB5129957 15.02.1544.048
Microsoft heeft kwetsbaarheden verholpen in Exchange. Een kwaadwillende kan de kwetsbaarheden misbruiken om zich voor te doen als andere gebruiker, zich verhoogde rechten toe te kennen en willekeurige code uit te voeren met rechten van het proces.
Microsoft Exchange Server · Elevation of Privilege
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), only with admin rights and without any user action.
CVSS 9.1 out of 10: critical. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server Subscription Edition RTM: KB5121608 15.02.2562.049
Microsoft Exchange Server 2019 Cumulative Update 14: KB5121610 15.02.1544.046
Microsoft Exchange Server 2019 Cumulative Update 15: KB5121609 15.02.1748.051
Microsoft Exchange Server 2016 Cumulative Update 23: KB5121611 15.01.2507.073
Microsoft Exchange Server · Elevation of Privilege
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.1 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2016 Cumulative Update 23: KB5121611 15.01.2507.073
Microsoft Exchange Server Subscription Edition RTM: KB5121608 15.02.2562.049
Microsoft Exchange Server 2019 Cumulative Update 14: KB5121610 15.02.1544.046
Microsoft Exchange Server 2019 Cumulative Update 15: KB5121609 15.02.1748.051
Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.
What does this mean?
Tampering.An attacker can change data or settings without permission.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2019 Cumulative Update 14: KB5121610 15.02.1544.046
Microsoft Exchange Server 2019 Cumulative Update 15: KB5121609 15.02.1748.051
Microsoft Exchange Server 2016 Cumulative Update 23: KB5121611 15.01.2507.073
Microsoft Exchange Server Subscription Edition RTM: KB5121608 15.02.2562.049
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server Subscription Edition RTM: KB5121608 15.02.2562.049
Microsoft Exchange Server 2016 Cumulative Update 23: KB5121611 15.01.2507.073
Microsoft Exchange Server 2019 Cumulative Update 15: KB5121609 15.02.1748.051
Microsoft Exchange Server 2019 Cumulative Update 14: KB5121610 15.02.1544.046
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 9.3 out of 10: critical. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2016 Cumulative Update 23: KB5121611 15.01.2507.073
Microsoft Exchange Server Subscription Edition RTM: KB5121608 15.02.2562.049
Microsoft Exchange Server 2019 Cumulative Update 15: KB5121609 15.02.1748.051
Microsoft Exchange Server 2019 Cumulative Update 14: KB5121610 15.02.1544.046
External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server Subscription Edition RTM: KB5121608 15.02.2562.049
Microsoft Exchange Server 2016 Cumulative Update 23: KB5121611 15.01.2507.073
Microsoft Exchange Server 2019 Cumulative Update 14: KB5121610 15.02.1544.046
Microsoft Exchange Server 2019 Cumulative Update 15: KB5121609 15.02.1748.051
Microsoft Exchange Server · Elevation of Privilege
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2016 Cumulative Update 23: KB5121576 15.01.2507.072
Microsoft Exchange Server Subscription Edition RTM: KB5121573 15.02.2562.046
Microsoft Exchange Server 2019 Cumulative Update 14: KB5121575 15.02.1544.044
Microsoft Exchange Server 2019 Cumulative Update 15: KB5121574 15.02.1748.049
Microsoft Exchange Server · Security Feature Bypass
Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network.
What does this mean?
Security Feature Bypass.An attacker can get around a security feature.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2016 Cumulative Update 23: KB5121576 15.01.2507.072
Microsoft Exchange Server 2019 Cumulative Update 14: KB5121575 15.02.1544.044
Microsoft Exchange Server 2019 Cumulative Update 15: KB5121574 15.02.1748.049
Microsoft Exchange Server Subscription Edition RTM: KB5121573 15.02.2562.046
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 7.3 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2019 Cumulative Update 14: KB5121575 15.02.1544.044
Microsoft Exchange Server 2019 Cumulative Update 15: KB5121574 15.02.1748.049
Microsoft Exchange Server Subscription Edition RTM: KB5121573 15.02.2562.046
Microsoft Exchange Server 2016 Cumulative Update 23: KB5121576 15.01.2507.072
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2019 Cumulative Update 14: KB5121575 15.02.1544.044
Microsoft Exchange Server 2019 Cumulative Update 15: KB5121574 15.02.1748.049
Microsoft Exchange Server Subscription Edition RTM: KB5121573 15.02.2562.046
Microsoft Exchange Server 2016 Cumulative Update 23: KB5121576 15.01.2507.072
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.
What does this mean?
Denial of Service.An attacker can make the service or server unavailable or slow.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2019 Cumulative Update 14: KB5121575 15.02.1544.044
Microsoft Exchange Server 2016 Cumulative Update 23: KB5121576 15.01.2507.072
Microsoft Exchange Server 2019 Cumulative Update 15: KB5121574 15.02.1748.049
Microsoft Exchange Server Subscription Edition RTM: KB5121573 15.02.2562.046
Microsoft Exchange Server · Elevation of Privilege
Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), only with admin rights and without any user action.
CVSS 7.2 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2019 Cumulative Update 14: KB5121575 15.02.1544.044
Microsoft Exchange Server 2019 Cumulative Update 15: KB5121574 15.02.1748.049
Microsoft Exchange Server 2016 Cumulative Update 23: KB5121576 15.01.2507.072
Microsoft Exchange Server Subscription Edition RTM: KB5121573 15.02.2562.046
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2019 Cumulative Update 14: KB5103214 15.02.1544.043
Microsoft Exchange Server 2019 Cumulative Update 15: KB5103213 15.02.1748.048
Microsoft Exchange Server Subscription Edition RTM: KB5103212 15.02.2562.045
Microsoft Exchange Server 2016 Cumulative Update 23: KB5103215 15.01.2507.071
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.1 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2019 Cumulative Update 14: KB5103214 15.02.1544.043
Microsoft Exchange Server 2016 Cumulative Update 23: KB5103215 15.01.2507.071
Microsoft Exchange Server Subscription Edition RTM: KB5103212 15.02.2562.045
Microsoft Exchange Server 2019 Cumulative Update 15: KB5103213 15.02.1748.048
Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 7.5 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server Subscription Edition RTM: KB5103212 15.02.2562.045
Microsoft Exchange Server 2019 Cumulative Update 15: KB5103213 15.02.1748.048
Microsoft Exchange Server 2019 Cumulative Update 14: KB5103214 15.02.1544.043
Microsoft Exchange Server 2016 Cumulative Update 23: KB5103215 15.01.2507.071
Microsoft Exchange Server · Elevation of Privilege
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2019 Cumulative Update 14: KB5103214 15.02.1544.043
Microsoft Exchange Server 2016 Cumulative Update 23: KB5103215 15.01.2507.071
Microsoft Exchange Server 2019 Cumulative Update 15: KB5103213 15.02.1748.048
Microsoft Exchange Server Subscription Edition RTM: KB5103212 15.02.2562.045
Microsoft Exchange Server · Information Disclosure
Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.1 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2019 Cumulative Update 14: KB5103214 15.02.1544.043
Microsoft Exchange Server 2019 Cumulative Update 15: KB5103213 15.02.1748.048
Microsoft Exchange Server Subscription Edition RTM: KB5103212 15.02.2562.045
Microsoft Exchange Server 2016 Cumulative Update 23: KB5103215 15.01.2507.071
Microsoft Exchange Server · Information Disclosure
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 5.0 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server Subscription Edition RTM: KB5103212 15.02.2562.045
Microsoft Exchange Server 2016 Cumulative Update 23: KB5103215 15.01.2507.071
Microsoft Exchange Server 2019 Cumulative Update 15: KB5103213 15.02.1748.048
Microsoft Exchange Server 2019 Cumulative Update 14: KB5103214 15.02.1544.043
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2019 Cumulative Update 14: KB5103214 15.02.1544.043
Microsoft Exchange Server 2019 Cumulative Update 15: KB5103213 15.02.1748.048
Microsoft Exchange Server 2016 Cumulative Update 23: KB5103215 15.01.2507.071
Microsoft Exchange Server Subscription Edition RTM: KB5103212 15.02.2562.045
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.1 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Exchange Server 2016 Cumulative Update 23: KB5103215 15.01.2507.071
Microsoft Exchange Server 2019 Cumulative Update 15: KB5103213 15.02.1748.048
Microsoft Exchange Server Subscription Edition RTM: KB5103212 15.02.2562.045
Microsoft Exchange Server 2019 Cumulative Update 14: KB5103214 15.02.1544.043
Microsoft Office SharePoint · Remote Code Execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported yet, but Microsoft expects exploitation to be likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 9.6 out of 10: critical. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Microsoft heeft xxx kwetsbaarheden verholpen in diverse Office producten, zoals Word, Excel, Access, Outlook, Visio, Sharepoint en PowerPoint, maar ook subcomponenten als Shell, Azure Key Vault en Click-to-Run. Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zich verhoogde rechten toe te kennen, willekeurige code uit te voeren en toegang te krijgen tot gevoelige informatie in de context van het slachtoffer.
Voor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden een malafide bestand te openen of link te volgen.
Van de kwetsbaarheid met kenmerk CVE-2026-96951 meldt Microsoft bekend te zijn met het feit dat deze beperkt en gericht is misbruikt. Er is geen Proof-of-Concept-code (PoC) of exploit bekend en succesvol misbruik vereist social engineering.
What does this mean?
NCSC rates the likelihood of abuse as medium and the possible impact as high.
40 vulnerabilities. See "Show CVE information" for each CVE.
Affects: Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 for 32-bit editions, Microsoft Office LTSC 2021 for 64-bit editions, Microsoft Office LTSC 2024 for 32-bit editions ….
What should you do?Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.1 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server 2019
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.
What does this mean?
Tampering.An attacker can change data or settings without permission.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.8 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 7.5 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 7.3 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Information Disclosure
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Information Disclosure
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), only with admin rights and without any user action.
CVSS 7.2 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Information Disclosure
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 7.5 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Information Disclosure
Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), only with admin rights and without any user action.
CVSS 4.9 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 7.5 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
Microsoft SharePoint Server 2019
Microsoft SharePoint Enterprise Server 2016
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 4.3 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Information Disclosure
Improper input validation in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 7.4 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Information Disclosure
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft heeft xxx kwetsbaarheden verholpen in diverse Office producten, zoals Word, Excel, Access, Outlook, Visio, Sharepoint en PowerPoint, maar ook subcomponenten als Shell, Azure Key Vault en Click-to-Run. Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zich verhoogde rechten toe te kennen, willekeurige code uit te voeren en toegang te krijgen tot gevoelige informatie in de context van het slachtoffer.
Microsoft Office SharePoint · Elevation of Privilege
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft heeft xxx kwetsbaarheden verholpen in diverse Office producten, zoals Word, Excel, Access, Outlook, Visio, Sharepoint en PowerPoint, maar ook subcomponenten als Shell, Azure Key Vault en Click-to-Run. Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zich verhoogde rechten toe te kennen, willekeurige code uit te voeren en toegang te krijgen tot gevoelige informatie in de context van het slachtoffer.
Microsoft Office SharePoint · Elevation of Privilege
Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft heeft xxx kwetsbaarheden verholpen in diverse Office producten, zoals Word, Excel, Access, Outlook, Visio, Sharepoint en PowerPoint, maar ook subcomponenten als Shell, Azure Key Vault en Click-to-Run. Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zich verhoogde rechten toe te kennen, willekeurige code uit te voeren en toegang te krijgen tot gevoelige informatie in de context van het slachtoffer.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002927 16.0.20326.20190
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft heeft xxx kwetsbaarheden verholpen in diverse Office producten, zoals Word, Excel, Access, Outlook, Visio, Sharepoint en PowerPoint, maar ook subcomponenten als Shell, Azure Key Vault en Click-to-Run. Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zich verhoogde rechten toe te kennen, willekeurige code uit te voeren en toegang te krijgen tot gevoelige informatie in de context van het slachtoffer.
Microsoft Office SharePoint · Information Disclosure
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 3.5 out of 10: low. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002908 16.0.20326.20082
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Time-of-check time-of-use (toctou) race condition in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 7.5 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002908 16.0.20326.20090
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002908 16.0.20326.20090
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002908 16.0.20326.20094
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002908 16.0.20326.20090
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Information Disclosure
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002908 16.0.20326.20082
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Information Disclosure
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002908 16.0.20326.20082
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), only with admin rights and if a user takes part, for example by opening a link or file.
CVSS 3.5 out of 10: low. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002908 16.0.20326.20090
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002908 16.0.20326.20074
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002908 16.0.20326.20090
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 7.3 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002908 16.0.20326.20090
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Information Disclosure
Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002908 16.0.20326.20090
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 7.3 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002908 16.0.20326.20090
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002908 16.0.20326.20090
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002908 16.0.20326.20082
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002908 16.0.20326.20090
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 7.3 out of 10: high. Microsoft rates it Important.
No attacks reported yet, but Microsoft expects exploitation to be likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 9.3 out of 10: critical. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 7.3 out of 10: high. Microsoft rates it Important.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.
What does this mean?
Tampering.An attacker can change data or settings without permission.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Information Disclosure
Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
Microsoft SharePoint Enterprise Server 2016: KB5002905 16.0.5565.1001
Microsoft SharePoint Enterprise Server 2016: KB5002906 16.0.5565.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 8.0 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002893 16.0.19725.20522
Microsoft SharePoint Server 2019: KB5002894 16.0.10417.20198
Microsoft SharePoint Server 2019: KB5002896 16.0.10417.20198
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002882 16.0.19725.20434
Microsoft SharePoint Server 2019: KB5002883 16.0.10417.20175
Microsoft SharePoint Enterprise Server 2016: KB5002891 16.0.5561.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server 2019: KB5002883 16.0.10417.20175
Microsoft SharePoint Enterprise Server 2016: KB5002891 16.0.5561.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 5.4 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002882 16.0.19725.20434
Microsoft SharePoint Server 2019: KB5002883 16.0.10417.20175
Microsoft SharePoint Enterprise Server 2016: KB5002891 16.0.5561.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002882 16.0.19725.20434
Microsoft SharePoint Server 2019: KB5002883 16.0.10417.20175
Microsoft SharePoint Enterprise Server 2016: KB5002891 16.0.5561.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 7.3 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Enterprise Server 2016: KB5002891 16.0.5561.1001
Microsoft SharePoint Server Subscription Edition: KB5002882 16.0.19725.20434
Microsoft SharePoint Server 2019: KB5002883 16.0.10417.20175
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002882 16.0.19725.20434
Microsoft SharePoint Server 2019: KB5002883 16.0.10417.20175
Microsoft SharePoint Enterprise Server 2016: KB5002891 16.0.5561.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Information Disclosure
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002882 16.0.19725.20434
Microsoft SharePoint Server 2019: KB5002883 16.0.10417.20175
Microsoft SharePoint Enterprise Server 2016: KB5002891 16.0.5561.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 7.3 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002882 16.0.19725.20434
Microsoft SharePoint Server 2019: KB5002883 16.0.10417.20175
Microsoft SharePoint Enterprise Server 2016: KB5002891 16.0.5561.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002882 16.0.19725.20434
Microsoft SharePoint Server 2019: KB5002883 16.0.10417.20175
Microsoft SharePoint Enterprise Server 2016: KB5002891 16.0.5561.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 7.3 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002882 16.0.19725.20434
Microsoft SharePoint Server 2019: KB5002883 16.0.10417.20175
Microsoft SharePoint Enterprise Server 2016: KB5002891 16.0.5561.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002882 16.0.19725.20434
Microsoft SharePoint Server 2019: KB5002883 16.0.10417.20175
Microsoft SharePoint Enterprise Server 2016: KB5002891 16.0.5561.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002882 16.0.19725.20434
Microsoft SharePoint Server 2019: KB5002883 16.0.10417.20175
Microsoft SharePoint Enterprise Server 2016: KB5002891 16.0.5561.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002882 16.0.19725.20434
Microsoft SharePoint Server 2019: KB5002883 16.0.10417.20175
Microsoft SharePoint Enterprise Server 2016: KB5002891 16.0.5561.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002882 16.0.19725.20434
Microsoft SharePoint Server 2019: KB5002883 16.0.10417.20175
Microsoft SharePoint Enterprise Server 2016: KB5002891 16.0.5561.1001
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 5.4 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 5.4 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 5.4 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 7.3 out of 10: high. Microsoft rates it Important.
No attacks reported yet, but Microsoft expects exploitation to be likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 8.0 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Elevation of Privilege
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 7.3 out of 10: high. Microsoft rates it Important.
No attacks reported yet, but Microsoft expects exploitation to be likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 5.4 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 5.4 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 5.4 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 5.4 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Microsoft Office SharePoint · Remote Code Execution
Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 8.0 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server Subscription Edition: KB5002863 16.0.19725.20280
Microsoft SharePoint Server 2019: KB5002870 16.0.10417.20128
Microsoft SharePoint Enterprise Server 2016: KB5002868 16.0.5552.1002
This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Office Online Server: KB5002928 16.0.10417.20228
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Office Online Server: KB5002928 16.0.10417.20228
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Office Online Server: KB5002928 16.0.10417.20228
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Office Online Server: KB5002928 16.0.10417.20228
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes
Office Online Server: KB5002928 16.0.10417.20228
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Office Online Server: KB5002928 16.0.10417.20228
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Office Online Server: KB5002928 16.0.10417.20228
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Office Online Server: KB5002928 16.0.10417.20228
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Office Online Server: KB5002928 16.0.10417.20228
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office PowerPoint · Remote Code Execution
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 7.5 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office PowerPoint · Remote Code Execution
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office PowerPoint · Remote Code Execution
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Office Online Server: KB5002928 16.0.10417.20228
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office 2016 (32-bit edition): KB5002916 16.0.5569.1003
Microsoft Office 2019 for 64-bit editions: KBRelease Notes 16.0.10417.20207
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes 16.0.20326.20138
Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes 16.0.20326.20138
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes 16.0.20326.20138
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Outlook 2016 (64-bit edition): KB5002919 16.0.5569.1000
Microsoft Outlook 2016 (32-bit edition): KB5002919 16.0.5569.1000
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 2016 (64-bit edition): KB5002916 16.0.5569.1000
Microsoft Office 2016 (32-bit edition): KB5002916 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 7.5 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes 16.0.20326.20138
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office LTSC for Mac 2021: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office 2019 for 32-bit editions: KBRelease Notes 16.0.10417.20207
Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Windows Server 2012 R2 (Server Core installation): KB5123066 6.3.9600.23398
Windows Server 2012 R2: KB5123066 6.3.9600.23398
Windows Server 2012 (Server Core installation): KB5123065 6.2.9200.26349
Windows Server 2016: KB5123099 10.0.14393.9512
Windows Server 2016 (Server Core installation): KB5123099 10.0.14393.9512
Microsoft Office PowerPoint · Remote Code Execution
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft PowerPoint 2016 (32-bit edition): KB5002920 16.0.5569.1000
Microsoft PowerPoint 2016 (64-bit edition): KB5002920 16.0.5569.1000
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office PowerPoint · Remote Code Execution
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft PowerPoint 2016 (64-bit edition): KB5002920 16.0.5569.1000
Microsoft PowerPoint 2016 (32-bit edition): KB5002920 16.0.5569.1000
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office PowerPoint · Remote Code Execution
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes 16.0.20326.20138
Microsoft PowerPoint 2016 (64-bit edition): KB5002920 16.0.5569.1000
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft PowerPoint 2016 (32-bit edition): KB5002920 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Use after free in Microsoft Office allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes 16.0.20326.20138
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 2016 (64-bit edition): KB5002916 16.0.5569.1000
Microsoft Office 2016 (32-bit edition): KB5002916 16.0.5569.1000
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office 2019 for 32-bit editions: KBRelease Notes 16.0.10417.20207
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Office Online Server: KB5002928 16.0.10417.20228
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Office Online Server: KB5002928 16.0.10417.20228
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Office Online Server: KB5002928 16.0.10417.20228
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Office Online Server: KB5002928 16.0.10417.20228
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office 365 for Mac: KBRelease Notes
Office Online Server: KB5002928 16.0.10417.20228
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Office Online Server: KB5002928 16.0.10417.20228
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Office Online Server: KB5002928 16.0.10417.20228
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Office Online Server: KB5002928 16.0.10417.20228
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Office Online Server: KB5002928 16.0.10417.20228
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Office Online Server: KB5002928 16.0.10417.20228
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Office Online Server: KB5002928 16.0.10417.20228
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Office Online Server: KB5002928 16.0.10417.20228
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Office Online Server: KB5002928 16.0.10417.20228
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Buffer underwrite ('buffer underflow') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Office Online Server: KB5002928 16.0.10417.20228
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Office Online Server: KB5002928 16.0.10417.20228
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Office Online Server: KB5002928 16.0.10417.20228
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office PowerPoint · Information Disclosure
Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office PowerPoint · Information Disclosure
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft heeft xxx kwetsbaarheden verholpen in diverse Office producten, zoals Word, Excel, Access, Outlook, Visio, Sharepoint en PowerPoint, maar ook subcomponenten als Shell, Azure Key Vault en Click-to-Run. Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zich verhoogde rechten toe te kennen, willekeurige code uit te voeren en toegang te krijgen tot gevoelige informatie in de context van het slachtoffer.
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft heeft xxx kwetsbaarheden verholpen in diverse Office producten, zoals Word, Excel, Access, Outlook, Visio, Sharepoint en PowerPoint, maar ook subcomponenten als Shell, Azure Key Vault en Click-to-Run. Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zich verhoogde rechten toe te kennen, willekeurige code uit te voeren en toegang te krijgen tot gevoelige informatie in de context van het slachtoffer.
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20934
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20878
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20878
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20934
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 7.5 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 7.5 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office PowerPoint · Remote Code Execution
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 7.5 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 7.5 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20974
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
Office Online Server: KB5002928 16.0.10417.20228
Microsoft Office LTSC for Mac 2024: KBRelease Notes
Microsoft Office LTSC for Mac 2021: KBRelease Notes
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBClick to Run https://aka.ms/OfficeSecurityReleases
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
CVSS 5.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 2016 (64-bit edition): KB5002904 16.0.5569.1003
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Excel 2016 (64-bit edition): KB5002914 16.0.5569.1003
Microsoft Office 2016 (32-bit edition): KB5002904 16.0.5569.1003
Microsoft Excel 2016 (32-bit edition): KB5002914 16.0.5569.1003
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
CVSS 5.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office 2016 (64-bit edition): KB5002904 16.0.5569.1003
Microsoft Office 2016 (32-bit edition): KB5002904 16.0.5569.1003
Microsoft Excel 2016 (32-bit edition): KB5002914 16.0.5569.1003
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Excel 2016 (64-bit edition): KB5002914 16.0.5569.1003
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
CVSS 5.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office 2016 (64-bit edition): KB5002904 16.0.5569.1003
Microsoft Office 2016 (32-bit edition): KB5002904 16.0.5569.1003
Microsoft Excel 2016 (32-bit edition): KB5002914 16.0.5569.1003
Microsoft Excel 2016 (64-bit edition): KB5002914 16.0.5569.1003
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office Publisher · Remote Code Execution
Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Publisher 2016 (64-bit edition): KB5002644 16.0.5569.1002
Microsoft Office 2019 for 64-bit editions: KBRelease Notes 16.0.10417.20207
Microsoft Publisher 2016 (32-bit edition): KB5002644 16.0.5569.1002
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes 16.0.20326.20138
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 2016 (64-bit edition): KB5002916 16.0.5569.1000
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office 2016 (32-bit edition): KB5002916 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 2016 (64-bit edition): KB5002916 16.0.5569.1000
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office 2016 (32-bit edition): KB5002916 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC for Mac 2021: KBRelease Notes 16.113.26091433
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office 2016 (64-bit edition): KB5002916 16.0.5569.1000
Microsoft Office 2016 (32-bit edition): KB5002916 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office 2016 (64-bit edition): KB5002916 16.0.5569.1000
Microsoft Office 2016 (32-bit edition): KB5002916 16.0.5569.1000
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office PowerPoint · Information Disclosure
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC for Mac 2021: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 2019 for 64-bit editions: KBRelease Notes 16.0.10417.20207
Microsoft Office 2016 (64-bit edition): KB5002898 16.0.5569.1002
Microsoft Office 2016 (32-bit edition): KB5002898 16.0.5569.1002
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes 16.0.20326.20138
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office PowerPoint · Remote Code Execution
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes 16.0.20326.20138
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes 16.0.20326.20138
Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 2019 for 32-bit editions: KBRelease Notes 16.0.10417.20207
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 2019 for 32-bit editions: KBRelease Notes 16.0.10417.20207
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes 16.0.20326.20138
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Outlook 2016 (32-bit edition): KB5002919 16.0.5569.1000
Microsoft Outlook 2016 (64-bit edition): KB5002919 16.0.5569.1000
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office 2016 (32-bit edition): KB5002898 16.0.5569.1002
Microsoft Office 2016 (64-bit edition): KB5002898 16.0.5569.1002
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Out-of-bounds write in Microsoft Office allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office 2016 (32-bit edition): KB5002916 16.0.5569.1000
Microsoft Office 2016 (64-bit edition): KB5002916 16.0.5569.1000
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes 16.0.20326.20138
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office 2016 (64-bit edition): KB5002904 16.0.5569.1003
Microsoft Excel 2016 (64-bit edition): KB5002914 16.0.5569.1003
Microsoft Office 2016 (32-bit edition): KB5002904 16.0.5569.1003
Microsoft Excel 2016 (32-bit edition): KB5002914 16.0.5569.1003
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 2016 (64-bit edition): KB5002916 16.0.5569.1000
Microsoft Office 2016 (32-bit edition): KB5002916 16.0.5569.1000
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 2016 (64-bit edition): KB4011160 16.0.5569.1002
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office 2016 (32-bit edition): KB4011160 16.0.5569.1002
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1002
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1002
Microsoft Office LTSC for Mac 2024
Microsoft Office LTSC 2024 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20960
Null pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office PowerPoint · Information Disclosure
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft PowerPoint 2016 (64-bit edition): KB5002920 16.0.5569.1000
Microsoft PowerPoint 2016 (32-bit edition): KB5002920 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office PowerPoint · Information Disclosure
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft PowerPoint 2016 (32-bit edition): KB5002920 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft PowerPoint 2016 (64-bit edition): KB5002920 16.0.5569.1000
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes 16.0.20326.20138
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes 16.0.20326.20138
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 2016 (32-bit edition): KB5002916 16.0.5569.1000
Microsoft Office 2016 (64-bit edition): KB5002916 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes 16.0.20326.20138
Microsoft Office 2019 for 64-bit editions: KBRelease Notes 16.0.10417.20207
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office PowerPoint · Information Disclosure
Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes 16.0.20326.20138
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes 16.0.20326.20138
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office PowerPoint · Information Disclosure
Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes 16.0.20326.20138
Microsoft Office 2019 for 64-bit editions: KBRelease Notes 16.0.10417.20207
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office LTSC for Mac 2021: KBRelease Notes 16.113.26091433
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Access 2016 (64-bit edition): KB5002913 16.0.5569.1002
Microsoft Access 2016 (32-bit edition): KB5002913 16.0.5569.1002
Microsoft Office 2016 (64-bit edition): KB5002913 16.0.5569.1000
Microsoft Office 2016 (32-bit edition): KB5002913 16.0.5569.1000
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1002
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1002
Microsoft Office 2016 (64-bit edition): KB5002916 16.0.5569.1000
Microsoft Office 2016 (32-bit edition): KB5002916 16.0.5569.1000
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office Publisher · Remote Code Execution
Integer overflow or wraparound in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Publisher 2016 (64-bit edition): KB5002644 16.0.5569.1000
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Publisher 2016 (32-bit edition): KB5002644 16.0.5569.1000
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC for Mac 2021: KBRelease Notes 16.113.26091433
Microsoft Office 2016 (64-bit edition): KB5002916 16.0.5569.1000
Microsoft Office 2016 (32-bit edition): KB5002916 16.0.5569.1000
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Word 2016 (64-bit edition): KB5002916 16.0.5569.1003
Microsoft Word 2016 (32-bit edition): KB5002916 16.0.5569.1003
Microsoft Office 2016 (32-bit edition): KB5002916 16.0.5569.1000
Microsoft Office 2016 (64-bit edition): KB5002916 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 2019 for 64-bit editions: KBRelease Notes 16.0.10417.20207
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1002
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1002
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Outlook 2016 (32-bit edition): KB5002919 16.0.5569.1002
Microsoft Outlook 2016 (64-bit edition): KB5002919 16.0.5569.1002
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906
Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.113.26091433
Microsoft Office 2016 (64-bit edition): KB5002916 16.0.5569.1000
Microsoft Office 2016 (32-bit edition): KB5002916 16.0.5569.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Access 2016 (64-bit edition): KB5002912 16.0.5569.1002
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes 16.0.20326.20138
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Access 2016 (32-bit edition): KB5002912 16.0.5569.1002
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2021 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1002
Microsoft Office 365 for Mac
Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1002
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Access 2016 (32-bit edition): KB5002913 16.0.5569.1002
Microsoft Access 2016 (64-bit edition): KB5002913 16.0.5569.1002
Microsoft Office 2016 (32-bit edition): KB5002913 16.0.5569.1002
Microsoft Office 2016 (64-bit edition): KB5002913 16.0.5569.1002
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes 16.0.20131.20234
Microsoft Office 2016 (64-bit edition): KB5002916 16.0.5569.1000
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office 2016 (32-bit edition): KB5002916 16.0.5569.1000
Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Windows Server 2012 R2: KB5123066 6.3.9600.23398
Windows Server 2012 R2 (Server Core installation): KB5123066 6.3.9600.23398
Windows Server 2012 (Server Core installation): KB5123065 6.2.9200.26349
Windows Server 2016 (Server Core installation): KB5123099 10.0.14393.9512
Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office 2016 (32-bit edition): KB5002916 16.0.5569.1003
Microsoft Office 2016 (64-bit edition): KB5002916 16.0.5569.1003
Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20960
Microsoft Office LTSC 2021 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office 365 for Mac: KBRelease Notes 16.112.26081010
Microsoft Word 2016 (64-bit edition): KB5002901 16.0.5565.1000
Microsoft Word 2016 (32-bit edition): KB5002901 16.0.5565.1000
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.112.26081010
Microsoft Office LTSC 2024 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office 2019 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office 2019 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Office Online Server: KB5002884 16.0.10417.20175
Microsoft Excel 2016 (64-bit edition): KB5002903 16.0.5565.1001
Microsoft Excel 2016 (32-bit edition): KB5002903 16.0.5565.1001
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.112.26081010
Microsoft Office LTSC 2024 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Office Online Server: KB5002884 16.0.10417.20175
Microsoft Excel 2016 (64-bit edition): KB5002903 16.0.5565.1001
Microsoft Excel 2016 (32-bit edition): KB5002903 16.0.5565.1001
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.112.26081010
Microsoft Office LTSC 2024 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges locally.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited with access to the device itself, with an ordinary user account and without any user action.
CVSS 7.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office 2019 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office 2019 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Office Online Server: KB5002884 16.0.10417.20175
Microsoft Excel 2016 (64-bit edition): KB5002903 16.0.5565.1001
Microsoft Excel 2016 (32-bit edition): KB5002903 16.0.5565.1001
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.112.26081010
Microsoft Office LTSC 2024 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an unauthorized attacker to execute code locally.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
CVSS 7.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC 2024 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 64-bit Systems: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit Systems: KBClick to Run https://aka.ms/OfficeSecurityReleases
Insufficiently protected credentials in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 4.3 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Outlook 2016 (64-bit edition): KB5002755 16.0.5565.1000
Microsoft Outlook 2016 (32-bit edition): KB5002755 16.0.5565.1000
Microsoft Office LTSC 2024 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Excel 2016 (64-bit edition): KB5002886 16.0.5561.1001
Microsoft Excel 2016 (32-bit edition): KB5002886 16.0.5561.1001
Microsoft Office LTSC 2024 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.111.26071215
Microsoft Office LTSC 2024 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Office Online Server: KB5002884 16.0.10417.20175
Microsoft Office 365 for Mac: KBRelease Notes 16.111.26071215
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Project Server allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 4.6 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft SharePoint Server 2019: KB5002874 16.0.10417.20153
Microsoft SharePoint Enterprise Server 2016: KB5002880 16.0.5556.1005
Microsoft SharePoint Server Subscription Edition: KB5002873 16.0.19725.20384
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
CVSS 7.0 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Excel 2016 (64-bit edition): KB5002877 16.0.5556.1001
Microsoft Excel 2016 (32-bit edition): KB5002877 16.0.5556.1001
Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.110.26061317
Microsoft Office LTSC 2024 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2021 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
Improper neutralization of special elements used in a command ('command injection') in Outlook Copilot allows an authorized attacker to perform tampering over a network.
What does this mean?
Tampering.An attacker can change data or settings without permission.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 6.3 out of 10: medium. Microsoft rates it Moderate.
What should you do?Install the security update for the version you run (or a later cumulative update):
Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 9.6 out of 10: critical. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Microsoft Teams for Android · Information Disclosure
Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 5.8 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Teams for Android: KBRelease Notes 1.0.0.2026142702
Microsoft Teams for Android · Information Disclosure
Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 6.8 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Teams for Android: KBRelease Notes 1.0.0.2026133602
Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Teams for Android · Remote Code Execution
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Teams for Android: KBRelease Notes 1.0.0.2026133602
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Teams for Android: KBRelease Notes 1.0.0.2026142702
Microsoft Teams for Android · Information Disclosure
Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.1 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Teams for Android: KBRelease Notes 1.0.76.2026111302
Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 9.9 out of 10: critical. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Microsoft Azure Active Directory B2C · Elevation of Privilege
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
CVSS 10.0 out of 10: critical. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 9.9 out of 10: critical. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Microsoft Entra Provisioning Service (SyncFabric) · Elevation of Privilege
'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 9.9 out of 10: critical. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 9.9 out of 10: critical. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Microsoft Entra Provisioning Service (SyncFabric) · Elevation of Privilege
Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 9.9 out of 10: critical. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Entra ID allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Microsoft heeft kwetsbaarheden verholpen in diverse Dynamics componenten. Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de categorieën schade zoals benoemd in onderstaande tabellen:
NCSC rates the likelihood of abuse as medium and the possible impact as high.
6 vulnerabilities, highest CVSS 9.8. See "Show CVE information" for each CVE.
Affects: Microsoft Dataverse, Microsoft Dynamics 365 (on-premises) version 9.1, Microsoft Dynamics NAV 2017 on Windows Server 2012, Microsoft Dynamics NAV 2018 on Windows Server 2012.
What should you do?Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited with access to the device itself, without an account and without any user action.
CVSS 6.2 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Windows 11 Version 24H2 for x64-based Systems: KB5127648 10.0.26100.9711
Windows 11 Version 25H2 for x64-based Systems: KB5127648 10.0.26200.9711
Windows 11 Version 26H1 for ARM64-based Systems: KB5127646 10.0.28000.3231
Windows 11 version 26H1 for x64-based Systems: KB5127646 10.0.28000.3231
Windows 11 Version 24H2 for ARM64-based Systems: KB5127648 10.0.26100.9711
Microsoft Entra Connect Sync · Elevation of Privilege
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Entra Connect Sync allows an authorized attacker to elevate privileges locally.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited with access to the device itself, with an ordinary user account and without any user action.
CVSS 7.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft heeft kwetsbaarheden verholpen in de Configuration Manager en Defender. Een lokale kwaadwillende kan de kwetsbaarheden misbruiken om zich verhoogde rechten toe te kennen en mogelijk toegang te krijgen tot gevoelige gegevens.
Microsoft Defender for Endpoint:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-102204 | 7.80 | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|
What does this mean?
NCSC rates the likelihood of abuse as medium and the possible impact as high.
3 vulnerabilities. See "Show CVE information" for each CVE.
Affects: Microsoft Configuration Manager 2503, Microsoft Configuration Manager 2509, Microsoft Configuration Manager 2603, Microsoft Configuration Manager 2603 on .NET Core 2.1, Microsoft Defender for Endpoint for Linux, Windows Defender.
What should you do?Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
Microsoft Defender for Endpoint · Elevation of Privilege
Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited with access to the device itself, with an ordinary user account and without any user action.
CVSS 7.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft heeft kwetsbaarheden verholpen in de Configuration Manager en Defender. Een lokale kwaadwillende kan de kwetsbaarheden misbruiken om zich verhoogde rechten toe te kennen en mogelijk toegang te krijgen tot gevoelige gegevens.
Microsoft Defender for Endpoint · Information Disclosure
Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited with access to the device itself, with an ordinary user account and without any user action.
CVSS 5.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Defender for Endpoint for Mac: KBRelease Notes 101.26042.0020
Microsoft Purview eDiscovery · Elevation of Privilege
Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 7.7 out of 10: high. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 9.9 out of 10: critical. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Microsoft 365 Copilot's Business Chat · Information Disclosure
Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
CVSS 8.6 out of 10: high. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.1 out of 10: medium. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 9.3 out of 10: critical. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 9.9 out of 10: critical. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 9.3 out of 10: critical. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Microsoft 365 Copilot's Business Chat · Elevation of Privilege
Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.
What does this mean?
Tampering.An attacker can change data or settings without permission.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 7.7 out of 10: high. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Microsoft 365 Copilot for iOS · Elevation of Privilege
Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.1 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft 365 Copilot for iOS: KBRelease Notes 2.111.4
Microsoft heeft kwetsbaarheden verholpen in diverse Dynamics componenten. Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de categorieën schade zoals benoemd in onderstaande tabellen:
Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.5 out of 10: high. Microsoft rates it Critical.
What should you do?Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 8.0 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Microsoft Power Apps 2608.5
Microsoft Power Apps for Android: KBRelease Notes 3.26085.7
Microsoft heeft kwetsbaarheden verholpen in diverse Dynamics componenten. Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de categorieën schade zoals benoemd in onderstaande tabellen:
Improper input validation in Power BI allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Power BI Report Server: KBRelease Notes 1.26.9682.1442
Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 8.0 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Power BI Report Server: KBRelease Notes 1.26.9682.1442
Improper input validation in Power BI allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
CVSS 8.0 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Power BI Report Server: KBRelease Notes 1.25.9508.3237
Skype for Business and Microsoft Lync · Elevation of Privilege
Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Skype for Business Server Subscription Edition RTM: KBRelease Notes 7.0.2046.889
Skype for Business Server 2015 CU13: KB5132779 6.0.9319.886
Skype for Business Server 2019 CU8: KB5131693 7.0.2046.583
Skype for Business Server Subscription Edition CU1: KB5131692 7.0.2046.889
Skype for Business and Microsoft Lync · Elevation of Privilege
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
What does this mean?
Elevation of Privilege.An attacker can gain more rights than they should have, for example admin rights.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.1 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Skype for Business Server 2015 CU13: KB5132779 6.0.9319.886
Skype for Business Server 2019 CU8: KB5131693 7.0.2046.583
Skype for Business Server Subscription Edition CU1: KB5131692 7.0.2046.889
Skype for Business and Microsoft Lync · Remote Code Execution
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.
What does this mean?
Remote Code Execution.An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Skype for Business Server 2019 CU8: KB5131693 7.0.2046.583
Skype for Business Server 2015 CU13: KB5132779 6.0.9319.886
Skype for Business Server Subscription Edition CU1: KB5131692 7.0.2046.889
Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Skype for Business Server Subscription Edition CU1: KB5123287 7.0.2046.879
Skype for Business Server 2019 CU8: KB5123300 7.0.2046.569
Skype for Business Server 2015 CU13: KB5123301 6.0.9319.885
Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network.
What does this mean?
Denial of Service.An attacker can make the service or server unavailable or slow.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Skype for Business Server 2019 CU8: KB5123300 7.0.2046.569
Skype for Business Server 2015 CU13: KB5123301 6.0.9319.885
Skype for Business Server Subscription Edition CU1: KB5123287 7.0.2046.879
Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.
What does this mean?
Information Disclosure.An attacker can see information that is not meant for them.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Skype for Business Server Subscription Edition CU1: KB5123287 7.0.2046.879
Skype for Business Server 2015 CU13: KB5123301 6.0.9319.885
Skype for Business Server 2019 CU8: KB5123300 7.0.2046.569
Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 7.1 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Skype for Business Server 2019 CU8: KB5123300 7.0.2046.569
Skype for Business Server 2015 CU13: KB5123301 6.0.9319.885
Skype for Business Server Subscription Edition CU1: KB5123287 7.0.2046.879
Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network.
What does this mean?
Denial of Service.An attacker can make the service or server unavailable or slow.
It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Skype for Business Server 2015 CU13: KB5123301 6.0.9319.885
Skype for Business Server Subscription Edition CU1: KB5123287 7.0.2046.879
Skype for Business Server 2019 CU8: KB5123300 7.0.2046.569
Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
Spoofing.An attacker can pretend to be another user or source, for example through a misleading link or page.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 6.5 out of 10: medium. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do?Install the security update for the version you run (or a later cumulative update):
Skype for Business Server 2019 CU8: KB5123300 7.0.2046.569
Skype for Business Server Subscription Edition CU1: KB5123287 7.0.2046.879
Skype for Business Server 2015 CU13: KB5123301 6.0.9319.885
This site uses only functional storage to remember your language choice. With your consent, we also use Google Analytics to measure site usage.More in our privacy policy.
