365Fanatic / M365 Status / Security advisories / CVE-2026-97755
Microsoft Security Update Guide · Office / Microsoft 365 Apps

Microsoft Office Excel Remote Code Execution Vulnerability

Microsoft · EN CVE-2026-97755 Critical Action required CVSS 8.8

Published

SummaryDetailedSecurity

What does this mean?

  • Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
  • It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
  • CVSS 8.8 out of 10: high. Microsoft rates it Critical.
  • No attacks reported; Microsoft expects exploitation to be less likely.
  • What should you do? Install the security update for the version you run (or a later cumulative update):
    • Office Online Server: KB5002928 16.0.10417.20228
    • Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
    • Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes https://aka.ms/OfficeSecurityReleases
    • Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.21056
    • Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.21056
    • Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20974

Microsoft Office Excel · Remote Code Execution

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Office / Microsoft 365 Apps

How do I check if I am affected?

SharePoint Server: check and update

  1. Check your farm build in the SharePoint Management Shell:
    (Get-SPFarm).BuildVersion
    Or in Central Administration → Upgrade and Migration → Check product and patch installation status.
  2. If the build is equal to or higher than the build under "Affected products and updates" below, this vulnerability is fixed. A later cumulative update includes the fix too.
  3. Otherwise install the update on every server in the farm, then run the SharePoint Products Configuration Wizard, or:
    PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install
  4. You do not need to update SharePoint Online in Microsoft 365; Microsoft does that.

What kind of flaw is this?

Key facts

Released
13 okt 2026
Impact
Remote Code Execution
Max severity
Critical
Weakness
CWE-125: Out-of-bounds Read
CVSS 3.1
8.8 / 7.7 (base / temporal)
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Publicly disclosed
No
Exploited
No
Exploitability assessment
Exploitation Less Likely
Customer action required
Yes
Links
Microsoft Security Update Guide · CVE.org

CVSS metrics

Base score metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Affected products and updates

ProductUpdateBuild
Office Online ServerKB5002928 · Security Update16.0.10417.20228
Microsoft 365 Apps for Enterprise for 64-bit SystemsKBRelease Noteshttps://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise for 32-bit SystemsKBRelease Noteshttps://aka.ms/OfficeSecurityReleases
Microsoft Office LTSC 2024 for 32-bit editionsKBRelease Notes16.0.17932.21056
Microsoft Office LTSC 2024 for 64-bit editionsKBRelease Notes16.0.17932.21056
Microsoft Office LTSC 2021 for 32-bit editionsKBRelease Notes16.0.14334.20974
Microsoft Office LTSC 2021 for 64-bit editionsKBRelease Notes16.0.14334.20974
Microsoft SharePoint Server Subscription EditionKB500292716.0.20326.20190
Microsoft Office LTSC for Mac 2024KBRelease Notes—
Microsoft Office LTSC for Mac 2021KBRelease Notes—
Microsoft Office 365 for MacKBRelease Notes—

FAQ

Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
Are the updates for the Microsoft Office LTSC for Mac currently available?
The security update for Microsoft Office LTSC for Mac 2021 and 2024 are not immediately available. The updates will be released as soon as possible, and when they are available, customers will be notified via a revision to this CVE information.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it.

Revisions

VersionDateNote
113 okt 2026Information published.

This is in the weekly digest for week 42: everything that changed in Microsoft 365 this week. →

View at Microsoft → ← All security advisories

More security advisories for Office / Microsoft 365 Apps

All advisories for Office / Microsoft 365 Apps →

Source: Microsoft Security Update Guide. 365Fanatic is not affiliated with Microsoft.