365Fanatic / M365 Status / Security advisories / NCSC-2026-0422

NCSC security advisory · SharePoint

Kwetsbaarheden verholpen in Microsoft Office

NCSC · NL NCSC-2026-0422 Likelihood M · Impact H v1.00

Published 13 okt 2026

What does this mean?

NCSC rates the likelihood of abuse as medium and the possible impact as high.
40 vulnerabilities. See "Show CVE information" for each CVE.
Affects: Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 for 32-bit editions, Microsoft Office LTSC 2021 for 64-bit editions, Microsoft Office LTSC 2024 for 32-bit editions ….
What should you do? Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:

Microsoft heeft xxx kwetsbaarheden verholpen in diverse Office producten, zoals Word, Excel, Access, Outlook, Visio, Sharepoint en PowerPoint, maar ook subcomponenten als Shell, Azure Key Vault en Click-to-Run. Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zich verhoogde rechten toe te kennen, willekeurige code uit te voeren en toegang te krijgen tot gevoelige informatie in de context van het slachtoffer.

Voor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden een malafide bestand te openen of link te volgen.

Van de kwetsbaarheid met kenmerk CVE-2026-96951 meldt Microsoft bekend te zijn met het feit dat deze beperkt en gericht is misbruikt. Er is geen Proof-of-Concept-code (PoC) of exploit bekend en succesvol misbruik vereist social engineering.

Microsoft Office Click-To-Run: |------------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |------------------|------|-------------------------------------| | CVE-2026-70276 | 7.00 | Verkrijgen van verhoogde rechten | | CVE-2026-85340 | 7.80 | Verkrijgen van verhoogde rechten | |------------------|------|-------------------------------------|

SharePoint Outlook Office / Microsoft 365 Apps Skype for Business

Show CVE information (30)

CVE-2026-96951

View CVE-2026-96951 at Microsoft →

CVE-2026-70276ImportantCVSS 7.0

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.

CVE-2026-85340ImportantCVSS 7.8

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.

CVE-2026-102859ImportantCVSS 4.6

Microsoft Office SharePoint Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVE-2026-102860ImportantCVSS 8.8

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVE-2026-102861ImportantCVSS 8.8

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVE-2026-102862ImportantCVSS 8.8

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVE-2026-100209CriticalCVSS 8.8

Microsoft Office Excel Remote Code Execution Vulnerability

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-100210CriticalCVSS 8.8

Microsoft Office Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-100211CriticalCVSS 8.8

Microsoft Office Excel Remote Code Execution Vulnerability

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-100212ImportantCVSS 8.8

Microsoft Office Excel Remote Code Execution Vulnerability

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

CVE-2026-102849ImportantCVSS 8.8

Microsoft Office Access Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

CVE-2026-102850ImportantCVSS 8.8

Microsoft Office Access Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

CVE-2026-102855CriticalCVSS 8.8

Microsoft Office Visio Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.

CVE-2026-102856CriticalCVSS 8.8

Microsoft Office Visio Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.

CVE-2026-102857CriticalCVSS 8.8

Microsoft Office Visio Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.

CVE-2026-102863ImportantCVSS 8.8

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVE-2026-102864ImportantCVSS 4.6

Microsoft Office SharePoint Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVE-2026-102865ImportantCVSS 6.5

Microsoft Office SharePoint Information Disclosure Vulnerability

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

CVE-2026-102866CriticalCVSS 8.1

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-102867ImportantCVSS 6.5

Microsoft Office Word Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

CVE-2026-105013ImportantCVSS 7.4

Microsoft Office SharePoint Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2026-105591ImportantCVSS 8.8

Microsoft Office Access Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

CVE-2026-105592ImportantCVSS 7.5

Microsoft Office Access Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

CVE-2026-105593ImportantCVSS 8.8

Microsoft Office Access Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

CVE-2026-105595ImportantCVSS 8.8

Microsoft Office Access Remote Code Execution Vulnerability

Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

CVE-2026-105596ImportantCVSS 8.8

Microsoft Office Access Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

CVE-2026-105597ImportantCVSS 8.8

Microsoft Office Access Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

CVE-2026-105598ImportantCVSS 8.8

Microsoft Office Access Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

CVE-2026-105599ImportantCVSS 7.5

Microsoft Office PowerPoint Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

How do I check if I am affected?

SharePoint Server: check and update

Check your farm build in the SharePoint Management Shell:
```
(Get-SPFarm).BuildVersion
```
Or in Central Administration → Upgrade and Migration → Check product and patch installation status.
If the build is equal to or higher than the build under "Affected products and updates" below, this vulnerability is fixed. A later cumulative update includes the fix too.

Otherwise install the update on every server in the farm, then run the SharePoint Products Configuration Wizard, or:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

You do not need to update SharePoint Online in Microsoft 365; Microsoft does that.

What kind of flaw is this?

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
With a crafted path an attacker can read or write files outside the intended folder (path traversal).
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Input ends up unfiltered in a command, so an attacker can run their own commands (command injection).
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Input is not cleaned before it appears in a web page (cross-site scripting). An attacker can run script in another user's browser.
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Input ends up unfiltered in a database query (SQL injection).
CWE-94: Improper Control of Generation of Code ('Code Injection')
An attacker can supply code that the software then runs (code injection).

Key facts

Security Advisory

NCSC-2026-0422 [1.00]

Published

13 okt 2026

Likelihood / impact

Likelihood M · Impact H

Subject

Kwetsbaarheden verholpen in Microsoft Office

Weaknesses

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-36: Absolute Path Traversal
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-121: Stack-based Buffer Overflow
CWE-122: Heap-based Buffer Overflow
CWE-124: Buffer Underwrite ('Buffer Underflow')
CWE-125: Out-of-bounds Read
CWE-126: Buffer Over-read
CWE-190: Integer Overflow or Wraparound
CWE-191: Integer Underflow (Wrap or Wraparound)
CWE-193: Off-by-one Error
CWE-197: Numeric Truncation Error
CWE-203: Observable Discrepancy
CWE-270: Privilege Context Switching Error
CWE-346: Origin Validation Error
CWE-347: Improper Verification of Cryptographic Signature
CWE-415: Double Free
CWE-416: Use After Free
CWE-476: NULL Pointer Dereference
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
CWE-502: Deserialization of Untrusted Data
CWE-763: Release of Invalid Pointer or Reference
CWE-787: Out-of-bounds Write
CWE-807: Reliance on Untrusted Inputs in a Security Decision
CWE-822: Untrusted Pointer Dereference
CWE-829: Inclusion of Functionality from Untrusted Control Sphere
CWE-862: Missing Authorization
CWE-863: Incorrect Authorization
CWE-908: Use of Uninitialized Resource
CWE-918: Server-Side Request Forgery (SSRF)
CWE-923: Improper Restriction of Communication Channel to Intended Endpoints
CWE-1390: Weak Authentication

Revisions

Version	Date	Note
1.0.0	13-10-2026 20:36 CEST	Initiele versie

Description

Interpretation

Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zich verhoogde rechten toe te kennen, willekeurige code uit te voeren en toegang te krijgen tot gevoelige informatie in de context van het slachtoffer.

Voor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden een malafide bestand te openen of link te volgen.

Microsoft Office Click-To-Run:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-70276 | 7.00 | Verkrijgen van verhoogde rechten |
| CVE-2026-85340 | 7.80 | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|

Microsoft Office SharePoint:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-102859 | 4.60 | Voordoen als andere gebruiker |
| CVE-2026-102860 | 8.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-102861 | 8.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-102862 | 8.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-102863 | 8.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-102864 | 4.60 | Voordoen als andere gebruiker |
| CVE-2026-102865 | 6.50 | Toegang tot gevoelige gegevens |
| CVE-2026-102866 | 8.10 | Verkrijgen van verhoogde rechten |
| CVE-2026-105013 | 7.40 | Uitvoeren van willekeurige code |
| CVE-2026-105713 | 5.70 | Voordoen als andere gebruiker |
| CVE-2026-105719 | 6.50 | Toegang tot gevoelige gegevens |
| CVE-2026-105720 | 4.30 | Verkrijgen van verhoogde rechten |
| CVE-2026-69943 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-70202 | 7.50 | Verkrijgen van verhoogde rechten |
| CVE-2026-70217 | 4.90 | Toegang tot gevoelige gegevens |
| CVE-2026-70246 | 8.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-70251 | 7.50 | Verkrijgen van verhoogde rechten |
| CVE-2026-70259 | 6.50 | Toegang tot gevoelige gegevens |
| CVE-2026-70266 | 8.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-70267 | 7.20 | Uitvoeren van willekeurige code |
| CVE-2026-70298 | 6.50 | Toegang tot gevoelige gegevens |
| CVE-2026-85900 | 8.80 |…

Solutions

Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:

https://portal.msrc.microsoft.com/en-us/security-guidance

Products

Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 for 32-bit editions, Microsoft Office LTSC 2021 for 64-bit editions, Microsoft Office LTSC 2024 for 32-bit editions, Microsoft Office LTSC 2024 for 64-bit editions, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, Office Online Server, Outlook.com, Skype for Business Server 2015 CU13, Skype for Business Server 2019 CU8, Skype for Business Server Subscription Edition CU1

Source: NCSC CSAF advisory (CC0). Original at NCSC →

This is in the weekly digest for week 42: everything that changed in Microsoft 365 this week. →

Read the full advisory at NCSC → ← All security advisories

Source: NCSC, reused under CC0. 365Fanatic is not affiliated with NCSC.

Kwetsbaarheden verholpen in Microsoft Office

What does this mean?

How do I check if I am affected?

SharePoint Server: check and update

What kind of flaw is this?

Key facts

Revisions

Description

Interpretation

Solutions

Products

More security advisories for SharePoint

Display