365Fanatic / M365 Status / Security advisories / CVE-2026-45649
Microsoft Security Update Guide · Office / Microsoft 365 Apps

Office for Android Spoofing Vulnerability

Microsoft · EN CVE-2026-45649 Important Action required CVSS 7.1 Updated

Published · updated 19 jun 2026

SummaryDetailedSecurity

What does this mean?

  • Spoofing. An attacker can pretend to be another user or source, for example through a misleading link or page.
  • It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
  • CVSS 7.1 out of 10: high. Microsoft rates it Important.
  • No attacks reported; Microsoft expects exploitation to be less likely.
  • What should you do? Install the security update for the version you run (or a later cumulative update):
    • Microsoft Word for Android: KBRelease Notes 16.0.20131.20024
    • Microsoft PowerPoint for Android: KBRelease Notes 16.0.20131.20024
    • Microsoft Excel for Android: KBRelease Notes 16.0.20131.20024

Office for Android · Spoofing

Improper access control in Office for Android allows an unauthorized attacker to perform spoofing locally.

Office / Microsoft 365 Apps

How do I check if I am affected?

Update the app

  • Update the app through the App Store, Google Play or the app's own automatic updates.
  • If you manage devices with Intune, check in the Intune admin center which devices still run an older version.

What kind of flaw is this?

Key facts

Released
9 jun 2026
Last revised
19 jun 2026 (v2)
Impact
Spoofing
Max severity
Important
Weakness
CWE-284: Improper Access Control
CVSS 3.1
7.1 / 6.2 (base / temporal)
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
Publicly disclosed
No
Exploited
No
Exploitability assessment
Exploitation Unlikely
Customer action required
Yes
Links
Microsoft Security Update Guide · CVE.org

CVSS metrics

Base score metrics
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Affected products and updates

ProductUpdateBuild
Microsoft Word for AndroidKBRelease Notes · Security Update16.0.20131.20024
Microsoft PowerPoint for AndroidKBRelease Notes · Security Update16.0.20131.20024
Microsoft Excel for AndroidKBRelease Notes · Security Update16.0.20131.20024

FAQ

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it.
Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
Are the updates for Microsoft Word, PowerPoint, Excel for Android currently available?
Yes. As of June 15, 2026, the security update for Microsoft Word, PowerPoint, Excel for Android are available. Customers running Microsoft Word, PowerPoint, Excel for Android should ensure the update is installed to be protected from this vulnerability.

Revisions

VersionDateNote
219 jun 2026Microsoft is announcing the availability of the security updates for Microsoft Word, PowerPoint, Excel for Android. Customers running affected Microsoft Office for Android software should install the update for their product to be protected from this vulnerability.
19 jun 2026Information published.

What changed in Microsoft 365 this week? →

View at Microsoft → ← All security advisories

More security advisories for Office / Microsoft 365 Apps

All advisories for Office / Microsoft 365 Apps →

Source: Microsoft Security Update Guide. 365Fanatic is not affiliated with Microsoft.