365Fanatic / M365 Status / Security advisories / CVE-2026-69360
Microsoft Security Update Guide · Office / Microsoft 365 Apps

Microsoft Office Word Remote Code Execution Vulnerability

Microsoft · EN CVE-2026-69360 Important Action required CVSS 8.8

Published

SummaryDetailedSecurity

What does this mean?

  • Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
  • It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
  • CVSS 8.8 out of 10: high. Microsoft rates it Important.
  • No attacks reported; Microsoft expects exploitation to be less likely.
  • What should you do? Install the security update for the version you run (or a later cumulative update):
    • Windows Server 2012 R2: KB5123066 6.3.9600.23398
    • Windows Server 2012 R2 (Server Core installation): KB5123066 6.3.9600.23398
    • Windows Server 2012 (Server Core installation): KB5123065 6.2.9200.26349
    • Windows Server 2016 (Server Core installation): KB5123099 10.0.14393.9512
    • Windows Server 2012: KB5123065 6.2.9200.26349
    • Windows Server 2016: KB5123099 10.0.14393.9512

Microsoft Office Word · Remote Code Execution

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Office / Microsoft 365 Apps

What kind of flaw is this?

Key facts

Released
8 sep 2026
Impact
Remote Code Execution
Max severity
Important
Weakness
CWE-122: Heap-based Buffer Overflow
CVSS 3.1
8.8 / 7.7 (base / temporal)
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Publicly disclosed
No
Exploited
No
Exploitability assessment
Exploitation Less Likely
Customer action required
Yes
Links
Microsoft Security Update Guide · CVE.org

CVSS metrics

Base score metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Affected products and updates

ProductUpdateBuild
Windows Server 2012 R2KB5123066 · Monthly Rollup6.3.9600.23398
Windows Server 2012 R2 (Server Core installation)KB5123066 · Monthly Rollup6.3.9600.23398
Windows Server 2012 (Server Core installation)KB5123065 · Monthly Rollup6.2.9200.26349
Windows Server 2016 (Server Core installation)KB5123099 · Security Update10.0.14393.9512
Windows Server 2012KB5123065 · Monthly Rollup6.2.9200.26349
Windows Server 2016KB5123099 · Security Update10.0.14393.9512
Windows 10 Version 1607 for 32-bit SystemsKB5123099 · Security Update10.0.14393.9512
Windows 10 Version 1607 for x64-based SystemsKB5123099 · Security Update10.0.14393.9512
Windows Server 2025KB5122871 · Security Update10.0.26100.33438
Windows 11 Version 26H1 for ARM64-based SystemsKB5124012 · Security Update10.0.28000.2954
Windows 11 version 26H1 for x64-based SystemsKB5124012 · Security Update10.0.28000.2954
Windows 11 Version 23H2 for x64-based SystemsKB5122880 · Security Update10.0.22631.7582
Windows 11 Version 24H2 for x64-based SystemsKB5124008 · Security Update10.0.26100.9445
Windows 11 Version 24H2 for ARM64-based SystemsKB5124008 · Security Update10.0.26100.9445
Windows 11 Version 25H2 for ARM64-based SystemsKB5124008 · Security Update10.0.26200.9445
Windows 11 Version 23H2 for ARM64-based SystemsKB5122880 · Security Update10.0.22631.7582
Windows 11 Version 25H2 for x64-based SystemsKB5124008 · Security Update10.0.26200.9445
Windows 10 Version 22H2 for 32-bit SystemsKB5122878 · Security Update10.0.19045.7725
Windows Server 2025 (Server Core installation)KB5122871 · Security Update10.0.26100.33438
Windows 10 Version 22H2 for ARM64-based SystemsKB5122878 · Security Update10.0.19045.7725
Windows 10 Version 21H2 for x64-based SystemsKB5122878 · Security Update10.0.19044.7725
Windows 10 Version 22H2 for x64-based SystemsKB5122878 · Security Update10.0.19045.7725
Windows 10 Version 21H2 for ARM64-based SystemsKB5122878 · Security Update10.0.19044.7725
Windows 10 Version 21H2 for 32-bit SystemsKB5122878 · Security Update10.0.19044.7725
Windows Server 2022 (Server Core installation)KB5122882 · Security Update10.0.20348.5622
Windows Server 2022KB5122882 · Security Update10.0.20348.5622
Windows Server 2019 (Server Core installation)KB5122876 · Security Update10.0.17763.9245
Windows Server 2019KB5122876 · Security Update10.0.17763.9245
Windows 10 Version 1809 for 32-bit SystemsKB5122876 · Security Update10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsKB5122876 · Security Update10.0.17763.9245

FAQ

According to the CVSS metric, the attack vector is network (AV:N) and user interaction is required (UI:R). What is the target context of the remote code execution?
This attack requires a user to open a specially crafted file from the attacker to initiate remote code execution.

Revisions

VersionDateNote
18 sep 2026Information published.

This is in the weekly digest for week 37 · What changed this week? →

View at Microsoft → ← All security advisories

More security advisories for Office / Microsoft 365 Apps

All advisories for Office / Microsoft 365 Apps →

Source: Microsoft Security Update Guide. 365Fanatic is not affiliated with Microsoft.