This week in Microsoft 365
ISO week 42: service health, Message Center, the roadmap and security advisories from NCSC and Microsoft. Monday to Sunday. Open an item for the full post, or the Summary per source.
As an app on your iPhone or iPad: tap Share, then Add to Home Screen.
- Action by 30 Nov 2026 Microsoft 365 Copilot and Power Apps: Retirement of App Builder agent and vibe.powerapps.com
- Highest risk Microsoft Office Excel Remote Code Execution Vulnerability
- Highest risk Microsoft Office Excel Remote Code Execution Vulnerability
- Highest risk Microsoft Office Excel Remote Code Execution Vulnerability
- Highest risk Microsoft Office Excel Remote Code Execution Vulnerability
- Highest risk Microsoft Office Excel Remote Code Execution Vulnerability
- Highest risk Microsoft Office Excel Remote Code Execution Vulnerability
- Highest risk Microsoft Office Excel Remote Code Execution Vulnerability
+29 more in the lists below
What does this mean?
- Action needed: 1 Message Center post with a deadline. The first is 30 Nov 2026 (MC1505609).
- Information management: 21 changes touch Purview, retention, archiving or compliance, e.g. Microsoft Purview Audit: AuditLogQuery API generally available and Search-UnifiedAuditLog retiring (MC1505599). Check them against your retention policy.
- Stability: 15 service health items in the reference tenant, most in Microsoft 365 suite (3). Always check your own admin center.
No items match these filters.
Week 42 · 12–18 Oct 2026
237 new · 51 updatedM365 Status 11 / 4 Summary
New
User impact
Users' Microsoft Teams contact cards may not fully display Out of office text.
Current status
We've identified that a recent service change to the Microsoft Teams contact cards introduced a code regression in which the user interface (UI) of the Out of office text contains an invalid value and is causing impact. We're deploying a fix to correct the value and remediate the impact. We'll provide a timeline for the completion of the deployment as one becomes available.
Scope of impact
Any user attempting to view Out of office text on Microsoft Teams contact cards may be impacted.
Root cause
A recent service change to the Microsoft Teams contact cards introduced a code regression in which the user interface (UI) of the Out of office text contains an invalid value and is causing impact.
Next steps
Monday, October 19, 2026, at 9:00 PM UTC
More info
Selecting “See more” may not display the full Out of office message. Users may hover over the message to see the full text in a tool tip.
Updates
- We've identified that a recent service change to the Microsoft Teams contact cards introduced a code regression in which the user interface (UI) of the Out of office text contains an invalid value and is causing impact. We're deploying a fix to correct the value and remediate the impact. We'll provide a timeline for the completion of the deployment as one becomes available.
- We're reviewing the screenshots provided by a subset of affected users to gain clarity on the issue and determine the next steps to isolate the root cause.
- We're investigating a potential issue with Microsoft Teams and checking for impact to your organization. We'll provide an update within 30 minutes.
Next update by: Monday, October 19, 2026, at 9:00 PM UTC
User impact
Users may be unable to create or publish assignments in OneNote.
Current status
While our fix is continuing to deploy at a rate slower than originally anticipated, we're observing some reduction in the associated errors. However, our analysis of the infrastructure to which the fix has been deployed shows some portions aren't updating as expected, which is preventing the full remediation of the impact. We're analyzing these affected portions of infrastructure to determine whether there are any other actions necessary to totally resolve the issue.
Scope of impact
Impact is specific to some users attempting to create or publish assignments in Microsoft OneNote. Start time: Sunday, October 11, 2026, at 12:10 PM UTC
Root cause
A recent update to the authentication flow utilized in this event contained an issue, which is resulting in this issue.
Next steps
Friday, October 16, 2026, at 6:30 PM UTC
Updates
- While our fix is continuing to deploy at a rate slower than originally anticipated, we're observing some reduction in the associated errors. However, our analysis of the infrastructure to which the fix has been deployed shows some portions aren't updating as expected, which is preventing the full remediation of the impact. We're analyzing these affected portions of infrastructure to determine whether there are any other actions necessary to totally resolve the issue.
- We’ve begun deploying our fix to the affected environment and anticipate that this process will be complete by our next scheduled update.
- We’ve completed development of the fix and are preparing to deploy it across the affected environment. We’ll monitor service health as the deployment progresses to determine whether it is alleviating impact.
- We’re investigating elevated failures affecting assignment creation in Microsoft OneNote and are monitoring the affected environments to assess the extent of impact. We're developing and testing a fix as part of our mitigation efforts. Once validation is complete, we'll begin deploying the fix across the affected environment to restore service functionality.
Next update by: Friday, October 16, 2026, at 6:30 PM UTC
User impact
Users may be missing the "Meeting options" button for Microsoft Teams meetings in multiple Microsoft 365 apps.
Current status
We've received reports from multiple organizations noting that some users are missing the "Meeting options" button for Microsoft Teams meetings in multiple Microsoft 365 apps as listed in the "More info" section of this communication. We've isolated that a tenant filter to disable the "Meetings option" button for a specific group of users was unintentionally applied broadly. We're rolling back the offending change, and we anticipate impact to be remediated by our next scheduled update.
Scope of impact
This issue impacts some users who may be missing the "Meeting options” button when creating standard meetings using multiple Microsoft 365 apps. This section may be updated as the investigation progresses. Start time: Monday, October 12, 2026, at 8:48 PM UTC Estimated time to resolve: We anticipate impact to be resolved by our next scheduled update on Wednesday, October 14, 2026, at 9:00 PM UTC.
Root cause
A tenant filter to disable the "Meeting options" button for a specific organization was unintentionally applied broadly to multiple organizations.
Next steps
Wednesday, October 14, 2026, at 9:00 PM UTC
More info
This issue is occurring in the following Microsoft 365 apps: - Microsoft Teams desktop client - Microsoft Teams web client - Outlook on the web - Outlook desktop client The issue only occurs in standard Teams meetings, and live events, webinars, and town halls aren’t affected.
Updates
- We've received reports from multiple organizations noting that some users are missing the "Meeting options" button for Microsoft Teams meetings in multiple Microsoft 365 apps as listed in the "More info" section of this communication. We've isolated that a tenant filter to disable the "Meetings option" button for a specific group of users was unintentionally applied broadly. We're rolling back the offending change, and we anticipate impact to be remediated by our next scheduled update.
Next update by: Wednesday, October 14, 2026, at 9:00 PM UTC
User impact
Admins may encounter delays in accessing audit log data results in Microsoft Purview.
Current status
Our monitoring identified an increase in processing latency with Microsoft Purview audit log data. We've analyzed service telemetry and determined that a dependent service isn't processing requests as efficiently as expected, resulting in impact. We've taken action to rebalance load and improve throughput. While most users should see relief, we're continuing to monitor as the remaining backlog of events are processed, and we'll provide a complete remediation timeline once available.
Scope of impact
Any admin accessing audit log data from Microsoft Purview may be affected.
Next steps
Wednesday, October 21, 2026, at 6:00 PM UTC
More info
Affected users are encountering delays when accessing audit log data from the Microsoft Purview portal, Microsoft Graph API, or PowerShell.
Updates
- Our monitoring identified an increase in processing latency with Microsoft Purview audit log data. We've analyzed service telemetry and determined that a dependent service isn't processing requests as efficiently as expected, resulting in impact. We've taken action to rebalance load and improve throughput. While most users should see relief, we're continuing to monitor as the remaining backlog of events are processed, and we'll provide a complete remediation timeline once available.
Next update by: Wednesday, October 21, 2026, at 6:00 PM UTC
User impact
Admins may have been unable to review Service health or Message center postings in the Microsoft 365 admin center.
Current status
We're continuing to monitor recovery, and we anticipate some users will start to see remediation at this time. To ensure impact is fully remediated, we've extended our monitoring period, and we anticipate impact to be resolved by our next scheduled update.
Scope of impact
This issue affected some admins attempting to review Service health or Message center postings in the Microsoft 365 admin center or see new activities in the “What’s new” tab in the Microsoft Teams admin center. Start time: Monday, October 12, 2026, at 9:54 PM UTC End time: Tuesday, October 13, 2026, at 7:35 PM UTC
Root cause
A recent service update introduced a misconfiguration which caused the Service Health and Communications API to return authentication errors, resulting in impact. Next steps: - We're analyzing the offending service update to determine why the potential for impact wasn't caught during our internal update testing and validation phases. This further analysis will help us to improve our update implementation processes moving forward to ensure similar impact scenarios don't occur in the future. This is the final update for the event.
Next steps
Tuesday, October 13, 2026, at 10:00 PM UTC
More info
Admins' "What's new" tab in the Microsoft Teams admin center may have been blank and displayed an error stating, "We can't load data. Try again." Final status: We've completed our monitoring period and validated that the rollback of the service update containing the misconfiguration successfully remediated impact.
Updates
- Title: Admins may be unable to review Service health or Message center postings in the Microsoft 365 admin center User impact: Admins may have been unable to review Service health or Message center postings in the Microsoft 365 admin center. More info: Admins' "What's new" tab in the Microsoft Teams admin center may have been blank and displayed an error stating, "We can't load data. Try again." Final status: We've completed our monitoring period and validated that the rollback of the service update containing the misconfiguration successfully remediated impact. Scope of impact: This issue affected some admins attempting to review Service health or Message center postings in the Microsoft 365 admin center or see new activities in the “What’s new” tab in the Microsoft Teams admin center. Start time: Monday, October 12, 2026, at 9:54 PM UTC End time: Tuesday, October 13, 2026, at 7:35 PM UTC Root cause: A recent service update introduced a misconfiguration which caused the Service Health and Communications API to return authentication errors, resulting in impact. Next steps: - We're analyzing the offending service update to determine why the potential for impact wasn't caught during our internal update testing and validation phases. This further analysis will help us to improve our update implementation processes moving forward to ensure similar impact scenarios don't occur in the future. This is the final update for the event.
- We're continuing to monitor recovery, and we anticipate some users will start to see remediation at this time. To ensure impact is fully remediated, we've extended our monitoring period, and we anticipate impact to be resolved by our next scheduled update.
- We've received reports from a subset of affected users who have reported that they are unable to review Service health or Message center postings in the Microsoft 365 admin center or see new activities in the “What’s new” tab in the Microsoft Teams admin center. We've isolated that a recent service update introduced a misconfiguration which causes the Service Health and Communications API to return authentication errors, resulting in impact. We're rolling back the offending update and monitoring for remediation. We anticipate impact to be resolved by our next scheduled update.
- We're investigating a potential issue with the Microsoft 365 suite and checking for impact to your organization. We'll provide an update within 30 minutes.
Next update by: Tuesday, October 13, 2026, at 10:00 PM UTC
User impact
Admins are unable to access the EAC.
Current status
Our testing has identified a recent Exchange admin center (EAC) configuration change as a potential contributor to the access failures and associated HTTP 302 redirects. We’re rolling back the change, which we expect to complete within approximately two hours. Once complete, we’ll monitor the environment to determine whether this resolves the impact.
Scope of impact
Impact was specific to admins attempting to access the EAC. Start time: Monday, October 12, 2026, at 8:15 AM UTC End time: Monday, October 12, 2026, at 12:50 PM UTC Preliminary root cause: A recent EAC configuration change resulted in unexpected HTTP responses within the affected request path, preventing admins from successfully accessing the EAC. Reverting the identified change restored expected service functionality. Next steps: - We’re reviewing the identified EAC change and associated service configuration to help prevent similar impact from recurring. - We’re reviewing our monitoring and telemetry to improve detection and alerting for similar service behavior. We’ll provide a preliminary Post-Incident Report within two business days and a final Post-Incident Report within five business days.
Next steps
Monday, October 12, 2026, at 1:30 PM UTC
More info
When attempting to access the Exchange admin center, affected admins encountered an “Internal Server Error” message. Final status: We've completed the rollback of the identified Exchange admin center (EAC) change. Service telemetry shows that errors have returned to expected levels, and user reports have confirmed that EAC access has been restored. Admins who continue to experience impact should close their existing EAC browser session, open a new session, and retry accessing the EAC. We’ll continue to monitor service health to ensure sustained service stability.
Updates
- A post-incident report has been published.
- A post-incident report has been published.
- Title: Admins are unable to access the Exchange admin center (EAC) User impact: Admins are unable to access the EAC. More info: When attempting to access the Exchange admin center, affected admins encountered an “Internal Server Error” message. Final status: We've completed the rollback of the identified Exchange admin center (EAC) change. Service telemetry shows that errors have returned to expected levels, and user reports have confirmed that EAC access has been restored. Admins who continue to experience impact should close their existing EAC browser session, open a new session, and retry accessing the EAC. We’ll continue to monitor service health to ensure sustained service stability. Scope of impact: Impact was specific to admins attempting to access the EAC. Start time: Monday, October 12, 2026, at 8:15 AM UTC End time: Monday, October 12, 2026, at 12:50 PM UTC Preliminary root cause: A recent EAC configuration change resulted in unexpected HTTP responses within the affected request path, preventing admins from successfully accessing the EAC. Reverting the identified change restored expected service functionality. Next steps: - We’re reviewing the identified EAC change and associated service configuration to help prevent similar impact from recurring. - We’re reviewing our monitoring and telemetry to improve detection and alerting for similar service behavior. We’ll provide a preliminary Post-Incident Report within two business days and a final Post-Incident Report within five business days.
- We’ve completed the rollback and are continuing to monitor service health, with telemetry showing errors trending downward from their earlier peak. Admins who continue to experience impact should close their existing Exchange admin center (EAC) browser session, open a new session, and retry accessing the EAC. We’ll continue monitoring to validate recovery. This quick update is designed to give the latest information on this issue. Next update by: Monday, October 12, 2026, at 1:30 PM UTC
- We’re continuing to roll back the identified Exchange admin center (EAC) change. Initial telemetry shows errors trending downward from their earlier peak, and we’re monitoring service health to determine whether the rollback restores access for affected admins. This quick update is designed to give the latest information on this issue. Next update by: Monday, October 12, 2026, at 1:30 PM UTC
- Our testing has identified a recent Exchange admin center (EAC) configuration change as a potential contributor to the access failures and associated HTTP 302 redirects. We’re rolling back the change, which we expect to complete within approximately two hours. Once complete, we’ll monitor the environment to determine whether this resolves the impact.
- We’re continuing to test the rollback of the recent Exchange admin center (EAC) change while monitoring the results to determine if this resolves the impact. In parallel, we’re continuing our analysis of the unexpected HTTP 302 redirects to help determine the source of the issue. This quick update is designed to give the latest information on this issue. Next update by: Monday, October 12, 2026, at 12:30 AM UTC
- We’re continuing to investigate the unexpected HTTP 302 redirects and are testing a rollback of a recent Exchange admin center (EAC) change to determine if this resolves the impact. We’re also comparing results across affected environments to determine our next steps.
Next update by: Monday, October 12, 2026, at 1:30 PM UTC
User impact
Users may have been unable to access or protect content using ARM in Microsoft 365 services.
Current status
We’ve redirected traffic away from affected infrastructure to allow the unhealthy service components to recover. Following this action, we’ve observed service recovery across all affected regions. We’re monitoring service health to confirm that recovery remains stable while we continue investigating the root cause.
Scope of impact
Some users attempting to encrypt, decrypt, open, upload, or download protected content across Microsoft 365 services that rely on ARM, including Microsoft Purview and Power BI, or publish agents or add skills to existing agents in Microsoft 365 Copilot Chat, may have been impacted. Start time: Monday, October 12, 2026, at 7:00 AM UTC End time: Monday, October 12, 2026, at 10:21 AM UTC
Root cause
A section of the ARM service infrastructure that facilitates the processing of cached service data was underperforming, resulting in impact. Next steps: - We’re reviewing performance data and trends on the affected infrastructure to help prevent similar impact from happening again.
Next steps
Monday, October 12, 2026, at 12:30 PM UTC
More info
Impact may have prevented users from encrypting, decrypting, or opening protected files and email messages across Microsoft 365 services that rely on ARM. This included protection capabilities in Microsoft Purview, encrypted documents, protected file uploads and downloads in SharePoint Online, related Power BI and dependent service functionality, and publishing agents or adding skills to existing agents in Microsoft 365 Copilot Chat. Final status: We’ve determined that a section of the ARM service infrastructure that facilitates the processing of cached service data was underperforming, resulting in impact. We’ve confirmed, following a period of monitoring service telemetry, that the mitigating actions successfully resolved the issue.
Updates
- Title: Users may have been unable to access or protect content using Azure Rights Management (ARM) in Microsoft 365 services User impact: Users may have been unable to access or protect content using ARM in Microsoft 365 services. More info: Impact may have prevented users from encrypting, decrypting, or opening protected files and email messages across Microsoft 365 services that rely on ARM. This included protection capabilities in Microsoft Purview, encrypted documents, protected file uploads and downloads in SharePoint Online, related Power BI and dependent service functionality, and publishing agents or adding skills to existing agents in Microsoft 365 Copilot Chat. Final status: We’ve determined that a section of the ARM service infrastructure that facilitates the processing of cached service data was underperforming, resulting in impact. We’ve confirmed, following a period of monitoring service telemetry, that the mitigating actions successfully resolved the issue. Scope of impact: Some users attempting to encrypt, decrypt, open, upload, or download protected content across Microsoft 365 services that rely on ARM, including Microsoft Purview and Power BI, or publish agents or add skills to existing agents in Microsoft 365 Copilot Chat, may have been impacted. Start time: Monday, October 12, 2026, at 7:00 AM UTC End time: Monday, October 12, 2026, at 10:21 AM UTC Root cause: A section of the ARM service infrastructure that facilitates the processing of cached service data was underperforming, resulting in impact. Next steps: - We’re reviewing performance data and trends on the affected infrastructure to help prevent similar impact from happening again.
- We’ve redirected traffic away from affected infrastructure to allow the unhealthy service components to recover. Following this action, we’ve observed service recovery across all affected regions. We’re monitoring service health to confirm that recovery remains stable while we continue investigating the root cause.
- We’ve identified that some service components responsible for processing ARM requests are in an unhealthy state. We’re attempting to restart the affected components to mitigate impact. We’re seeing early signs of service recovery and are investigating the root cause while evaluating whether additional mitigation actions are required.
Next update by: Monday, October 12, 2026, at 12:30 PM UTC
User impact
Users may have been unable to view or modify custom forms in SharePoint Online.
Current status
We're continuing to deploy our fix to the affected environments and anticipate that deployment will be completed within 48 hours. We'll provide the latest deployment progress and updated completion timeline in our next update.
Scope of impact
This issue may have impacted any user attempting to view or modify Nintex or SPFx Customizers forms in SharePoint Online. Start time: Monday, October 12, 2026, at 1:00 AM UTC End time: Wednesday, October 14, 2026, at 5:52 PM UTC
Root cause
A recent API change to the SharePoint Online infrastructure introduced an incompatibility in how requests from custom forms are processed, resulting in impact. Next steps: - We're reviewing our testing and validation procedures to help prevent similar impact in the future. We'll provide a preliminary Post-Incident Report within two business days and a final Post-Incident Report within five business days.
Next steps
Wednesday, October 14, 2026, at 6:00 PM UTC
More info
Affected users may have encountered multiple potential scenarios with Nintex and SharePoint Framework (SPFx) Customizers forms, including: - Blank pages - Null target exceptions Final status: We've completed deployment of the fix to all affected environments, and we've confirmed with impacted organizations that the issue is no longer occurring.
Updates
- Title: Users may be unable to view or modify custom forms in SharePoint Online User impact: Users may have been unable to view or modify custom forms in SharePoint Online. More info: Affected users may have encountered multiple potential scenarios with Nintex and SharePoint Framework (SPFx) Customizers forms, including: - Blank pages - Null target exceptions Final status: We've completed deployment of the fix to all affected environments, and we've confirmed with impacted organizations that the issue is no longer occurring. Scope of impact: This issue may have impacted any user attempting to view or modify Nintex or SPFx Customizers forms in SharePoint Online. Start time: Monday, October 12, 2026, at 1:00 AM UTC End time: Wednesday, October 14, 2026, at 5:52 PM UTC Root cause: A recent API change to the SharePoint Online infrastructure introduced an incompatibility in how requests from custom forms are processed, resulting in impact. Next steps: - We're reviewing our testing and validation procedures to help prevent similar impact in the future. We'll provide a preliminary Post-Incident Report within two business days and a final Post-Incident Report within five business days.
- We're continuing to deploy our fix to the affected environments and anticipate that deployment will be completed within 48 hours. We'll provide the latest deployment progress and updated completion timeline in our next update.
- We've confirmed a recent API change as the source of the impact and have prevented it from reaching any further environments. We're continuing to deploy our fix to the affected environments to remediate the impact.
- We’ve isolated a recent API change as the suspected source of the impact. We’ve initiated the process of deploying a fix to confirm our findings and potentially remediate the impact.
- We're continuing our analysis of the HAR captures to determine the cause of impact.
- We're expanding our investigation to include HTTP Archive format (HAR) browser captures of the issue in progress to assist in isolating the underlying cause of impact and develop a remediation strategy.
- We're reviewing support case details to better understand the impact scenario and determine our next steps.
- We're investigating a potential issue with SharePoint Online and checking for impact to your organization. We'll provide an update within 30 minutes.
Next update by: Wednesday, October 14, 2026, at 6:00 PM UTC
User impact
Users' Microsoft 365 Copilot document editing prompts may have failed in the Microsoft Word desktop app and web clients. Final status: After completing our analysis of the trend of increased traffic we observed through service health telemetry, we've determined that the service is healthy and a service incident didn't actually occur. This communication will expire in 24 hours. This is the final update for the event.
Current status
We've identified a trend of increased traffic through our analysis of service health telemetry that we believe may be contributing to this event. We're continuing our investigation to confirm our theory and develop our next steps.
Scope of impact
This issue may impact any user who is attempting to complete Copilot prompts in the Word desktop app or Office for the web. This information may be updated as our investigation continues.
Next steps
Tuesday, October 13, 2026, at 10:00 PM UTC
Updates
- Title: Users' Microsoft 365 Copilot document editing prompts may fail in the Microsoft Word desktop app and web clients User impact: Users' Microsoft 365 Copilot document editing prompts may have failed in the Microsoft Word desktop app and web clients. Final status: After completing our analysis of the trend of increased traffic we observed through service health telemetry, we've determined that the service is healthy and a service incident didn't actually occur. This communication will expire in 24 hours. This is the final update for the event.
- We've identified a trend of increased traffic through our analysis of service health telemetry that we believe may be contributing to this event. We're continuing our investigation to confirm our theory and develop our next steps.
- We're investigating service health telemetry to determine why these prompts are failing to complete.
- We're investigating a potential issue impacting Microsoft 365 Copilot Chat and checking for impact to your organization. We'll provide an update within 30 minutes.
Next update by: Tuesday, October 13, 2026, at 10:00 PM UTC
User impact
Users may have been unable to access multiple Microsoft 365 services using GSA.
Current status
We're finishing our restarts throughout the affected infrastructure and expect this will be complete and resolve all impact by Tuesday, October 13, 2026, at 7:00 PM UTC. Our telemetry is showing service recovery, and we'll continue to monitor to ensure full remediation.
Scope of impact
Some users in Germany that attempted to access Microsoft 365 services listed in the More info section using GSA may have been impacted. Start time: Tuesday, October 13, 2026, at 7:40 AM UTC End time: Tuesday, October 13, 2026, at 6:31 PM UTC
Root cause
A section of GSA infrastructure was performing below acceptable performance thresholds, affecting connectivity to Microsoft 365 services and resulting in impact. Next steps: - To help prevent similar impact in the future, we're further reviewing the GSA infrastructure and testing performance on the previously impacted portions of infrastructure. We'll provide a preliminary Post-Incident Report within two business days and a final Post-Incident Report within five business days.
Next steps
Tuesday, October 13, 2026, at 8:00 PM UTC
More info
Impacted services may have included, but not been limited to: - Outlook - Outlook on the web - OneDrive - SharePoint Online - Microsoft Teams - Windows 365 Cloud PCs Final status: We've completed our restarts throughout the affected infrastructure and confirmed through telemetry and user reports that this issue is resolved.
Updates
- Title: Users may be unable to access multiple Microsoft 365 services using Global Secure Access (GSA) User impact: Users may have been unable to access multiple Microsoft 365 services using GSA. More info: Impacted services may have included, but not been limited to: - Outlook - Outlook on the web - OneDrive - SharePoint Online - Microsoft Teams - Windows 365 Cloud PCs Final status: We've completed our restarts throughout the affected infrastructure and confirmed through telemetry and user reports that this issue is resolved. Scope of impact: Some users in Germany that attempted to access Microsoft 365 services listed in the More info section using GSA may have been impacted. Start time: Tuesday, October 13, 2026, at 7:40 AM UTC End time: Tuesday, October 13, 2026, at 6:31 PM UTC Root cause: A section of GSA infrastructure was performing below acceptable performance thresholds, affecting connectivity to Microsoft 365 services and resulting in impact. Next steps: - To help prevent similar impact in the future, we're further reviewing the GSA infrastructure and testing performance on the previously impacted portions of infrastructure. We'll provide a preliminary Post-Incident Report within two business days and a final Post-Incident Report within five business days.
- We're finishing our restarts throughout the affected infrastructure and expect this will be complete and resolve all impact by Tuesday, October 13, 2026, at 7:00 PM UTC. Our telemetry is showing service recovery, and we'll continue to monitor to ensure full remediation.
- As a workaround, users may disable GSA to access the affected Microsoft 365 services until the resolution of this incident. This quick update is designed to give the latest information on this issue.
- We're continuing our targeted restarts throughout the impacted infrastructure, and our telemetry shows services hosted on the restarted infrastructure are now operating at healthy service levels. We're also receiving confirmation that impact is resolved for some users.
- We're restarting a portion of impacted infrastructure where we've removed traffic and are seeing positive trends towards recovery. We've confirmed through internal testing that this resolves impact for some users and we're monitoring to validate the full recovery of the service.
- We've completed redirecting traffic to healthy infrastructure and are assessing for positive trends towards recovery. We're continuing to investigate additional mitigating actions to expedite remediation.
- We're redirecting traffic from the underperforming infrastructure to improve service health. We're monitoring to confirm this will fully resolve impact. This quick update is designed to give the latest information on this issue.
- We've deployed the traffic optimizations and although we saw a reduction of errors initially, this did not fully resolve the issue. We're continuing to troubleshoot the issue to develop additional mitigation strategies.
Next update by: Tuesday, October 13, 2026, at 8:00 PM UTC
User impact
Users were unable to see model selection options in Microsoft 365 Copilot chat.
Current status
We've identified a component responsible for producing the model selection options in Copilot chat was not functioning correctly. To mitigate impact, we've developed a fix which is currently being deployed to the affected infrastructure and we're monitoring this process closely to ensure it delivers the expected resolution.
Scope of impact
Some users attempting to access GPT, Claude, or other model selection options in Copilot chat were impacted. Start time: Wednesday, October 14, 2026, at 3:34 AM UTC End time: Wednesday, October 14, 2026, at 9:30 AM UTC Preliminary root cause: A recent change resulted in the component responsible for producing the model selection options in Copilot chat to not function correctly. Next steps: - We're analyzing service telemetry on the affected component to help prevent this problem from happening again. We’ll provide a preliminary Post-Incident Report within two business days and a final Post-Incident Report within five business days.
Next steps
Wednesday, October 14, 2026, at 11:00 AM UTC
More info
Affected users were unable to see GPT, Claude, or other available models within the model selection options in Copilot chat. Final status: We’ve verified through service telemetry and previously impacted users that the issue is now resolved.
Updates
- Title: Some users were unable to see model selection options in Microsoft 365 Copilot chat User impact: Users were unable to see model selection options in Microsoft 365 Copilot chat. More info: Affected users were unable to see GPT, Claude, or other available models within the model selection options in Copilot chat. Final status: We’ve verified through service telemetry and previously impacted users that the issue is now resolved. Scope of impact: Some users attempting to access GPT, Claude, or other model selection options in Copilot chat were impacted. Start time: Wednesday, October 14, 2026, at 3:34 AM UTC End time: Wednesday, October 14, 2026, at 9:30 AM UTC Preliminary root cause: A recent change resulted in the component responsible for producing the model selection options in Copilot chat to not function correctly. Next steps: - We're analyzing service telemetry on the affected component to help prevent this problem from happening again. We’ll provide a preliminary Post-Incident Report within two business days and a final Post-Incident Report within five business days.
- We've completed deploying the fix to the affected infrastructure, and we've verified in our internal environment that the model selection options have been restored within Copilot chat. We're now contacting affected customers directly to ensure the fix has produced the expected resolution. This quick update is designed to give the latest information on this issue.
- We've identified a component responsible for producing the model selection options in Copilot chat was not functioning correctly. To mitigate impact, we've developed a fix which is currently being deployed to the affected infrastructure and we're monitoring this process closely to ensure it delivers the expected resolution.
- We’re reviewing service monitoring telemetry and support provided information to determine why model selection options aren’t appearing as expected, in order to develop a remediation plan.
- We've received reports indicating an issue with model selection options in Copilot Chat. We're reviewing service monitoring telemetry to isolate the root cause and determine our next troubleshooting steps.
Next update by: Wednesday, October 14, 2026, at 11:00 AM UTC
Updated
User impact
Users may intermittently be unable to access their calendars in Outlook on the web and the new Outlook desktop client.
Current status
We’ve completed deployment of the fix to the initially affected service environment and expect this has remediated impact for users in that environment. The fix is continuing to propagate across the remaining affected environment, with this process expected to take approximately one additional week to complete. We’ll continue monitoring the deployment as it progresses to confirm that impact is fully remediated.
Scope of impact
Some users attempting to access their calendars through Outlook on the web or the new Outlook desktop client may intermittently be impacted. Start time: Tuesday, July 7, 2026, at 5:33 PM UTC
Root cause
The issue is related to the calendar cache state following a refresh, where the event-loading process may continue referencing outdated calendar data after the folder information is updated.
Next steps
Monday, October 19, 2026, at 10:00 AM UTC
More info
Impacted users may receive the following error message: “Can’t retrieve calendar events right now. Refresh the browser and try again.” As a workaround, impacted users can access their calendar in the classic Outlook desktop client.
Updates
- We’ve completed deployment of the fix to the initially affected service environment and expect this has remediated impact for users in that environment. The fix is continuing to propagate across the remaining affected environment, with this process expected to take approximately one additional week to complete. We’ll continue monitoring the deployment as it progresses to confirm that impact is fully remediated.
- Our fix deployment is completing for the initially identified service environment; however, we’ve confirmed that additional environments remain impacted. While some users should experience impact resolution as the fix reaches them, we’re extending the fix deployment to the remaining affected environments, and we’ll provide an estimation for its completion once available.
- Our fix deployment is completing and we're reaching out to some users to confirm the issue is no longer occurring.
- We’ve identified that the issue is related to the calendar cache state following a refresh, where the event-loading process may continue referencing outdated calendar data after the folder information is updated. We’ve implemented and merged a fix to ensure the refreshed calendar data is correctly used when loading subsequent events. The fix is expected to reach affected users by October 9, 2026.
- We’re continuing to review service health telemetry and HAR logs to investigate what we suspect is a caching issue that’s leading to the impact. We’re also testing potential solutions to confirm our findings and determine our next steps.
- Our review of service health telemetry and the HAR logs persists as we continue to isolate the source of this issue.
- We're currently reviewing telemetry and HTTP Archive format (HAR) log information as we investigate the cause of impact.
- We're investigating a potential issue with Exchange Online and checking for impact to your organization. We'll provide an update within 30 minutes.
Next update by: Monday, October 19, 2026, at 10:00 AM UTC
User impact
Users may be unable to reply or reply-all to email messages sent to Microsoft 365 groups in Exchange Online.
Current status
Our fix deployment has completed in the initial deployment rings and has started saturating in affected customers' environments. Our monitoring has validated that our fix has completed approximately 93 percent of the deployment, and we'll provide an updated timeline for it completing once it has become available.
Scope of impact
This issue impacts any user attempting to reply or reply-all to email messages sent to Microsoft 365 groups in Exchange Online. This information may be updated as our investigation continues. Start time: Tuesday, September 8, 2026, at 11:00 PM UTC
Root cause
A recent change made to the service removed an attribute component from the service process that requires that attribute, leading to impact.
Next steps
Thursday, October 15, 2026, at 8:30 PM UTC
More info
As a temporary alternative, impacted users may reply or reply all to email messages through user inboxes.
Updates
- Our fix deployment has completed in the initial deployment rings and has started saturating in affected customers' environments. Our monitoring has validated that our fix has completed approximately 93 percent of the deployment, and we'll provide an updated timeline for it completing once it has become available.
- Our monitoring of the deployment is ongoing as it propagates through earlier deployment rings prior to beginning saturation to affected customers’ environments. We'll provide a projected timeline for remediation based on the rate of progress as one becomes available.
- We're continuing to monitor and track the saturation percentage of the fix deployment to ensure it reaches 100 percent in all affected environments.
- We've validated that the previously identified recent change that removed an attribute component from the service process that requires that attribute, has led to impact. We're continuing to monitor our fix deployment; however, this process is taking longer than anticipated. The current fix saturation is at roughly 90 percent, and we'll provide a timeline of completion once it becomes available.
- We're continuing to monitor the deployment of our fix as it progresses, and we'll aim to provide a timeline of completion by our next scheduled communications.
- Our fix deployment is nearing completion, and most affected users should now be experiencing recovery. We’ll continue monitoring the deployment to ensure it completes and restores service for all affected users.
- Our fix deployment is nearing completion, and most affected users should now be experiencing recovery. We’ll continue monitoring the deployment to ensure it completes and restores service for all affected users.
- We've initialized our fix deployment to the affected environment and anticipate the impact should be fully remediated by our next scheduled update.
Next update by: Thursday, October 15, 2026, at 8:30 PM UTC
User impact
Admins may see stale data in the Copilot Health page in the Microsoft 365 admin center.
Current status
We're continuing our efforts to develop a fix to gather the missing data needed to restore our pipeline and remediate the impact. Once internal validations are complete, we'll provide a timeline for the deployment.
Scope of impact
Some admins attempting to see the latest Copilot Health data in the Microsoft 365 admin center may be impacted. This information may be updated as our investigation continues.
Root cause
An upstream process responsible for Copilot Health data was disabled, resulting in the impact.
Next steps
Friday, October 16, 2026, at 8:00 PM UTC
More info
Specifically, monthly data in the Update channels, Microsoft 365 updates (Past 6 months view), Connected experiences status, and OneDrive status cards on the Copilot Health page may not reflect data after July 2026. The Today view in the Microsoft 365 updates card isn't affected.
Updates
- We're continuing our efforts to develop a fix to gather the missing data needed to restore our pipeline and remediate the impact. Once internal validations are complete, we'll provide a timeline for the deployment.
- We're developing a fix that will gather the missing data necessary to restore our pipeline and to remediate the impact. We'll provide a timeline for the deployment of our solution once internal validations have been completed.
- We’ve confirmed that the pipeline responsible for processing Copilot Health data is running. We're working to gather the missing data so we can rerun the pipeline and resolve the issue.
- We've confirmed that impact associated with CP1482212 persists as the data was not processed as expected. We're validating that the data is present to be able to run the pipeline successfully and remediate impact completely.
Next update by: Friday, October 16, 2026, at 8:00 PM UTC
User impact
Admins may have received failures creating or updating Communications Compliance policies in Microsoft Purview.
Current status
We've completed the deployment to over 90 percent of the affected infrastructure. While most admins should see relief, we expect the release to complete by the next scheduled update.
Scope of impact
Some admins may have received failures when they created or updated Communications Compliance policies in Microsoft Purview with more than four classifiers. Start time: Monday, July 6, 2026, at 12:00 AM UTC End time: Friday, October 9, 2026, at 6:00 PM UTC
Root cause
A service update which intended to add operations with larger data sizes introduced a code error, causing size limitation issues. Next steps: We're reviewing and improving our service update validation procedure to prevent similar issues from occurring again in the future. This is the final update for this event.
Next steps
Monday, October 12, 2026, at 6:00 PM UTC
More info
Impact was limited to Communications Compliance policies with more than four classifiers. Final status: The fix deployed to the whole of the affected infrastructure, and we've confirmed with our internal monitoring telemetry that impact is remediated.
Updates
- Title: Some admins may receive failures creating or updating Communications Compliance policies in Microsoft Purview User impact: Admins may have received failures creating or updating Communications Compliance policies in Microsoft Purview. More info: Impact was limited to Communications Compliance policies with more than four classifiers. Final status: The fix deployed to the whole of the affected infrastructure, and we've confirmed with our internal monitoring telemetry that impact is remediated. Scope of impact: Some admins may have received failures when they created or updated Communications Compliance policies in Microsoft Purview with more than four classifiers. Start time: Monday, July 6, 2026, at 12:00 AM UTC End time: Friday, October 9, 2026, at 6:00 PM UTC Root cause: A service update which intended to add operations with larger data sizes introduced a code error, causing size limitation issues. Next steps: We're reviewing and improving our service update validation procedure to prevent similar issues from occurring again in the future. This is the final update for this event.
- We've completed the deployment to over 90 percent of the affected infrastructure. While most admins should see relief, we expect the release to complete by the next scheduled update.
- We've continuing to monitor the deployment of our fix which remains scheduled to complete by Monday, October 5, 2026.
- We've completed internal validations for our solution and have begun its deployment. Our fix deployment timeline projects the deployment will remediate the impact by Monday, October 5, 2026. Until this time, we advise users to keep Communications Compliance policies limited to under four classifiers in order to avoid impact.
- We've received reports from a subset of affected admins who have reported receiving size limitation failures when creating or updating Communications Compliance policies in Microsoft Purview. We've isolated that a recent update introduced operations with larger data size included a code issue, causing size limitation issues. We've created a code fix to address the issue, which we anticipate being fully deployed by Monday, October 5, 2026. During this time, we advise users to keep Communications Compliance policies limited to under four classifiers in order to avoid impact.
- We're investigating a potential issue with Microsoft Purview and checking for impact to your organization. We'll provide an update within 30 minutes.
Next update by: Monday, October 12, 2026, at 6:00 PM UTC
Message Center 13 / 17 Summary
New
What and why
Apps in Copilot Cowork are now available through the Frontier program, and Apps in Microsoft Copilot Studio are rolling out in public preview.To provide a unified experience for building apps with natural language, Microsoft is retiring the App Builder agent in Microsoft 365 Copilot and vibe.powerapps.com.
Copilot Cowork and Microsoft Copilot Studio will become the primary experiences for creating apps using natural language. This retirement helps consolidate app creation experiences and provides makers with a consistent path forward for building and managing apps.
What and why
Microsoft Teams will soon support sharing video directly from OneDrive during Teams events. Organizers and producers using Manage what attendees see can load videos from OneDrive and present them on stage without screen sharing a local media player or embedding videos in PowerPoint. This improvement provides smoother, higher-quality video playback for attendees and simplifies event production through built-in video playback controls.
What and why
We are updating the Brand Center setup experience so that administrators can set up Brand Center without enabling Public CDN.
Today, Public CDN is enabled as part of Brand Center setup, even when an organization only wants to use branding governance capabilities that do not require it. With this update, organizations can begin using Brand Center while deferring Public CDN until they need capabilities that depend on it, such as organizational fonts.
What and why
Users of new Outlook for Windows and Outlook on the web will be able to create inbox rules that automatically reply to incoming messages using a saved template. This helps users reduce repetitive work while providing faster, more consistent responses. This change supports personal and team productivity by automating routine email responses.
This message is associated with Microsoft 365 Roadmap ID 567318.
What and why
The Microsoft Graph AuditLogQuery API is generally available for programmatic access to Microsoft Purview Audit activity logs. We are also announcing the planned retirement of the Search-UnifiedAuditLog PowerShell cmdlet on October 15, 2027.
The AuditLogQuery API provides improved scalability and reliability, more granular workload-level permissions, and support for exporting up to 1 million audit records per query. As audit data volumes and automation scenarios have grown, Search-UnifiedAuditLog has reached scalability limitations that can affect reliability and performance for large-volume searches. Future investments and enhancements for audit search will focus on the AuditLogQuery API.
Sales Premium delivers the Sales Insights capabilities at the same price as the Sales Enterprise + Sales Insights combination. It also includes Copilot Credits, additional Dataverse storage capacity, and access to new Sales Premium capabilities. This change is intended to reduce licensing complexity.
How does this affect me?
Existing Sales Insights customers will retain access through the end of their current contract term, with no immediate disruption from this retirement.
At renewal, the Sales Insights add-on will no longer be available. Customers who want to continue using Sales Insights capabilities should transition to Dynamics 365 Sales Premium. Customers who do not need those capabilities may continue with Dynamics 365 Sales Enterprise.
What action do I need to take?
To prepare for this change:
What and why
We are introducing AI-generated status reports in Planner Agent. This feature uses Planner plan data to generate a status report that summarizes overall status, progress, risks, and next steps. Users can customize reports by specifying items such as audience, tone, length, reporting period, and report sections before reviewing and refining the generated content.
What and why
Microsoft Entra is changing who can create agent blueprints by default. Starting November 4, default users will be able to create new agent blueprints unless an administrator turns off Users can create agent blueprints. This means that users without built-in or custom Entra roles will be able to create new agent blueprints in their organization. From now until rollout begins, you can set your tenant preferences to prepare for this rollout. If you do not want users in your organization to create new agent blueprints and their identities, follow the instructions below.
What and why
We’re making updates across Microsoft Outlook experiences to improve clarity and consistency across endpoints. The first updates focus on visual details such as icons, spacing, and alignment, while maintaining familiar ways of working.
These updates are part of an ongoing series of improvements across Outlook experiences and are not a replacement for the classic Outlook experience.
What and why
Microsoft Entra Agent ID is enforcing tighter restrictions for autonomous creation of an agent’s own identities. Currently, all agents are granted AgentIdentity.CreateAsManager upon creation without administrator approval. Starting November 4, Microsoft Entra will no longer automatically grant AgentIdentity.CreateAsManager to agent blueprint principals, and creation of identities will need an admin to grant consent.
Agents that use app-only authentication to create their own agent identities must be explicitly granted the AgentIdentity.CreateAsManager Microsoft Graph application permission or move to another supported authorization model before enforcement reaches their tenant.
What and why
We’re removing the Agent 365 license requirement for observability data for supported agents built by Microsoft or on Microsoft platforms. This change expands access to usage and activity insights in the Microsoft 365 admin center, helping administrators monitor how agents are used.
This change is limited to observability metrics. It does not remove licensing requirements for other Agent 365 capabilities or for agent activity metrics for agents built on third-party platforms.
How does this affect me?
With this feature enabled, active Entra ID users who do not have a valid Dynamics 365 or Power Apps license can be selected in fields such as:
- Email: To, Cc, and Bcc
- Appointment: Owner, Required Attendees, and Optional Attendees
- Phone call: Owner, Call From, and Call To
- Task: Owner (co-owner)
This message is for awareness, and no action is required.
If you would like more information on this feature, please visit Add users without licenses to activity recipient fields (preview).
We've released updates to the following update channels for Microsoft 365 Apps:
- Current Channel
- Monthly Enterprise Channel
- Semi-Annual Enterprise Channel
Updated
Updated October 12, 2026: We have updated the content. Thank you for your patience.
What and why
Microsoft Teams is introducing AI generated meeting memory files that capture key insights from meetings (formerly archive files). These files help Microsoft 365 Copilot and Facilitator deliver more accurate context aware responses while maintaining strong privacy controls by not storing raw meeting content. This capability supports enterprise ready AI by improving knowledge grounding while keeping data secure and manageable.
This message is associated with Microsoft 365 Roadmap ID 558933.
Updated October 12, 2026: We have decided not to move forward with this change at this time. We apologize for any inconvenience.
Introduction
To improve reliability, compliance, and collaboration, we’re updating where Microsoft Whiteboard files created from a Teams Channel tab are stored. Previously, these whiteboards were saved in the OneDrive of the user who created them, which could lead to access issues due to sharing settings, Information Barriers, or Conditional Access policies.
With this update, whiteboards created from Teams Channels will be stored in the associated SharePoint site for the channel, aligning Whiteboard with the storage behavior of other Microsoft 365 apps and ensuring consistent access for all channel members.
Updated October 12, 2026: We have updated the timeline. Thank you for your patience.
Introduction
We are introducing a new capability that allows users to connect Microsoft Teams meetings to existing Microsoft Planner plans.
Currently, Teams meetings automatically create separate Planner plans for meeting-related tasks, which can result in tasks for the same initiative being spread across multiple plans. This update enables users to link meetings to an existing plan so tasks can be tracked in a single location, improving organization and continuity across ongoing work.
This message is associated with Roadmap ID 561490.
Updated October 1, 2026: We have updated the content and timeline. Thank you for your patience.
What it is
Microsoft is rolling out a new feature to streamline how app and agent availability and installation is managed across Teams, Outlook, and Microsoft 365 Copilot. Until now, IT admins configured availability and installation settings separately in both the Microsoft 365 Admin Center (MAC) and the Teams Admin Center (TAC), which led to mismatches. With this update, you’ll be able to unify availability and installation policies for apps and agents across both portals, making app management more consistent and efficient.
This message is associated with Microsoft 365 Roadmap ID 393931, 485712 and 503105.
Updated October 12, 2026: We have updated the timeline. Thank you for your patience.
What and why
Microsoft Purview Data Lifecycle Management now allows admins to archive SharePoint files based on retention policies. This helps organizations reduce storage costs by moving inactive content to Microsoft 365 Archive while maintaining compliance and discoverability. Archived content is excluded from Copilot indexing, which can improve the relevance of Copilot responses by focusing results on current, active data.
Updated October 12, 2026: We have updated the timeline. Thank you for your patience.
What and why
Microsoft Purview Data Lifecycle Management is introducing the ability to archive SharePoint files based on retention policies. This feature helps organizations reduce storage costs by moving inactive content to Microsoft 365 Archive while maintaining compliance and discoverability. By excluding archived content from Copilot indexing, organizations can also improve the relevance and quality of Copilot responses, ensuring users focus on current, active data.
This message is associated with Microsoft 365 Roadmap ID 561208.
What and why
We are introducing Full Workload Backup for Microsoft 365 Backup, a new capability that allows admins to quickly protect an entire workload (SharePoint, OneDrive, or Exchange) with a single policy. This feature automatically includes all existing and newly created artifacts that are not already covered by custom policies, helping organizations improve data protection coverage, reduce administrative overhead, and ensure continuous backup for critical business data at scale.
This enhancement supports enterprise-ready data protection and automation, enabling organizations to safeguard content more efficiently while maintaining control through existing policy configurations.
This message is associated with Microsoft 365 Roadmap ID 464990.
Updated October 13, 2026: We have updated the timeline. Thank you for your patience.
What and why
Microsoft Entra will soon recognize Windows Hello for Business (WHfB) and macOS Platform Single Sign-On (PSSO) as standalone multifactor authentication (MFA) factors in supported authentication scenarios.
Today, WHfB and macOS PSSO can satisfy MFA requirements during primary sign-in, but users may still be required to register and use an additional passkey or authentication method for certain step-up authentication prompts, Authentication Strength policies, and sign-in frequency checks.
After this rollout, users who authenticate with WHfB or macOS PSSO will be able to satisfy supported MFA requirements without registering an additional passkey. This change helps organizations expand the use of phishing-resistant authentication methods and reduce reliance on less secure authentication methods. As part of this change, a user's WHfB and macOS PSSO credentials will be displayed in My Security Info as auto-registered passkeys.
Updated October 13, 2026: We have updated the timeline. Thank you for your patience.
What and why
Microsoft Purview Information Protection is introducing File Labeler and File Viewer applications for macOS. These clients will bring sensitivity labeling and protected file viewing capabilities to Mac users, aligning with the experience already available on Windows.
This update will help organizations consistently apply and enforce protection policies across platforms, supporting enterprise-grade security and compliance for sensitive content across devices.
This message is associated with Microsoft 365 Roadmap ID 561327.
Updated October 13, 2026: We have updated the timeline. Thank you for your patience.
What and why
Microsoft Edge is introducing an upgraded Copilot new tab page that brings Microsoft 365 Copilot chat, web search, and work content into a single experience. Users can search the web, navigate to websites, interact with Microsoft 365 Copilot, and access relevant work content from a single experience.
The updated experience includes enhanced Copilot chat integration, compose capabilities, suggested actions, curated work content, and a refreshed design to help users complete tasks more efficiently.
This message is associated with Microsoft 365 Roadmap ID 566703.
Updated October 13, 2026: We have decided not to move forward with this change at this time. We will communicate via Message center when we are ready to proceed. We apologize for any inconvenience.
What and why
We are introducing Policy Sync and Device Health AI skills for Microsoft Purview Endpoint Data Loss Prevention. These AI-powered capabilities provide real-time visibility into policy deployment across devices and help admins quickly identify and resolve sync issues. By using AI to surface root causes and recommend actions, this feature improves troubleshooting efficiency and increases confidence that policies are enforced consistently across devices. This aligns with our enterprise-ready AI approach by delivering intelligent insights within Microsoft Purview.
Updated October 13, 2026: Following our earlier announcement, Apps in Copilot Studio has started its public preview rollout. Availability will expand gradually by region. Makers building apps in Copilot Studio will use the Copilot Credits available in the environment they're building in. Copilot Credits for app building are allocated, monitored, and billed through the same Power Platform admin center experience you already use for agents in Copilot Studio — no separate setup is required. Admins can review the credit allocation documentation in PPAC to learn more: https://learn.microsoft.com/en-us/power-platform/admin/manage-copilot-studio-copilot-credits-capacity
What and why
We are announcing a preview of the new app-building experience in Microsoft Copilot Cowork. A corresponding experience in Microsoft Copilot Studio will follow within the next couple of weeks. These experiences make it easier for people to turn ideas into apps using natural-language guidance and generative AI.
Updated October 13, 2026: We have updated the timeline. Thank you for your patience.
Enable admins to apply retention policy or retention label in OneDrive and SharePoint for files that have not been accessed by anyone in the organization after a period of time. In this release, users will be able to set up delete policies based on Last Accessed Date of Office file types. Non-office file types are not supported in this release.
This message is associated with Microsoft 365 Roadmap ID 472030.
Updated October 13, 2026: We have updated the timeline. Thank you for your patience.
What and why
We are updating the entry point for Copilot in Outlook to be more visually appealing and consistent. Located next to the Outlook ribbon, the Copilot entry point makes it easier for users to discover and use Copilot as they work. In addition to chat, it also surfaces contextual, AI-powered recommendations based on the task at hand, such as reading email, composing messages, or managing a calendar. With a single click, users can act on these suggestions to quickly summarize content, draft responses, organize information, and accomplish tasks more efficiently. The experience is designed to bring relevant Copilot capabilities closer to the user's workflow while providing a consistent Copilot experience across Microsoft 365 applications.
Updated October 13, 2026: We have updated the content. Thank you for your patience.
What and why
To improve transparency and troubleshooting for Microsoft Purview role-based access control (RBAC), we are enhancing audit logging for permission checks performed in the Microsoft Purview portal. These new audit records will provide administrators with clearer visibility into role and scoped-role authorization decisions, helping them investigate access issues and better understand how access evaluations are performed.
This message is associated with Microsoft 365 Roadmap ID 569363.
Updated September 18, 2026: We have updated the content. Thank you for your patience.
What and why
We are introducing a more consistent way for users to access and manage important resources in Microsoft Teams chats and channels. Users will be able to pin frequently used resources directly below the chat or channel header, pin multiple messages alongside other resources, and organize them into folders. On Microsoft Teams mobile, users will be able to access shared resources and folders by tapping the chat or channel header. This change will help users stay organized and provide them with a centralized location to quickly find, access, and manage important resources.
As part of this update, the In this chat and In this channel panes will be removed. Existing resources within these panes will be accessible through the new resource management experience.
Updated October 9, 2026: We have updated the content. Thank you for your patience.
What and why
We're introducing a new Microsoft Entra capability that allows password change after secure sign-in directly from My Sign-Ins using an existing strong credential, such as a passkey, FIDO2 security key, or Windows Hello for Business. Users can complete this action even if they don't know their current password and without using self-service password reset (SSPR) or contacting the helpdesk.
Many organizations are adopting allowed password changes after secure sign-ins but still maintain passwords for legacy applications and services. This update helps reduce password-related support requests and removes a common barrier to adoption. The feature is disabled by default and requires administrator enablement before users can access it.
Roadmap 26 / 29 Summary
New
Sales Development Agent now integrates with Salesforce, enabling organizations to use SDA with their existing Salesforce CRM. SDA can access leads, manage prospect records, log sales activities, and keep engagement actions—including qualification, disqualification, and ownership changes—connected to the CRM workflow. The integration uses Microsoft’s Salesforce Model Context Protocol (MCP) server to connect SDA with S…
Currently, to bring tasks from another project into a new project, you must manually enter the task details in the task grid or use schedule APIs. You can also use the Copy project feature to create a new project with the same tasks, but this feature has limitations: You copy the entire project, including unwanted tasks and extra information. You can't combine tasks from multiple projects into a new project. Wit…
Business performance planning improves the performance and flexibility of writeback from the Matrix visual. Writeback processing has been optimized to improve performance for planning adjustments, particularly for larger splash and multi-update operations. The improvements also optimize writeback for users with dimension security, where additional security validation is required. In addition, report designers no long…
Administrators can now assign Microsoft Dataverse group teams backed by Microsoft Entra groups to Business performance planning dimension security groups. Previously, dimension security assignments were limited to individual users. The updated experience allows administrators to view and add eligible Entra group-backed teams alongside users, with separate membership information for each assignment type. To use this c…
Create and manage contextual discussion threads directly on planning cubes and dimensions. Users can comment on dimension cells, detailed or aggregate cube cells, and reporting rows; reply to and mention colleagues; receive email notifications; and resolve or reactivate discussions. Public and private visibility options, together with an All Comments view, filters, export, and role-based management actions, support c…
With this feature, admins can scope their network data security data loss prevention policies, integrated with Entra GSA Internet Access, to apply to all websites (.) or all websites except specific cloud apps, allowing them to apply protection to cloud apps and websites that are not in the Defender Cloud App Catalog.
Enables auto‑labeling of existing SharePoint files to match the default sensitivity label configured on their document library. This helps organizations close labeling gaps for data at rest and ensure consistent, secure‑by‑default protection across SharePoint libraries—without relying on manual user labeling.
This feature posts a purchase order product receipt and the consumption of its linked project item requirement in one transaction. It applies when automatic item consumption is enabled or when you select Consume immediately while posting the product receipt. Both updates succeed together, or the system rolls them both back when an error occurs. The posting flow prevents duplicate project posting and preserves existin…
Review shared files without losing conversation context. When you open a PDF, Markdown, or HTML file from a Teams chat or channel message, the conversation appears alongside the file and takes you directly to where it was shared, allowing you to catch up on the discussion and respond without closing the file preview or switching back to chat.
Power Apps model-driven apps are now available as Business Apps in Work IQ. They can be accessed through the Work IQ (Preview) tool in Copilot Studio or through a natural-language chat experience powered by Work IQ MCP. In either experience, natural-language prompts let users list and read records or create, update, and delete them. For create and update, Work IQ maps supplied values to the appropriate app fields. Be…
Work IQ enables agents to create and edit Microsoft Office documents using organizational context, helping users produce and update content more efficiently.
Enable agents to upload files and content to supported Microsoft 365 destinations.
This is a new web part available for modern page editors in SharePoint. The web part can be configured to use any M365 Copilot agent.
Microsoft Purview Data Loss Prevention is extending Administrative Units support to Microsoft 365 Copilot, Copilot Chat, and Cowork. This enables organizations to delegate management of supported Copilot DLP policies to administrators within their assigned Administrative Units, supporting regional, departmental, and regulatory boundaries without granting tenant-wide policy-management permissions. Existing tenant-wide…
Microsoft Purview server-side auto-labeling will support legacy Microsoft Office file formats, including Word (.doc), Excel (.xls), and PowerPoint (.ppt). Organizations can automatically evaluate and apply sensitivity labels to these files in SharePoint and OneDrive.
The Microsoft Visio Desktop MCP Server enables compatible AI clients to connect with the Visio Desktop application to create, read, and update Visio diagrams using natural language. It runs locally on Windows and requires a licensed Visio Desktop application.
This feature provides reusable MCP tools for Store Commerce POS returns. These tools expose Commerce return capabilities as structured actions that customers, partners, and agent developers can use to build conversational or agentic return experiences. The tools enable agentic experiences to look up the original purchase using supported identifiers such as receipt, order, invoice, or confirmation number; retrieve mat…
Consolidated AI settings make it easier for makers and admins to find and manage AI capabilities for model-driven apps across two complementary surfaces. In Maker Studio, the Settings dialog in the model app form designer adds a new top-level Copilot and AI tab. Makers can see and adjust all available AI options for the app in one place instead of finding them scattered among all the other settings. In the Power Plat…
Business end-users and buyers can define and maintain their own outbound follow-up scenarios and use them wherever built-in scenarios are used today: Scenario maintenance — a dedicated setup page where users create, edit, and maintain custom follow-up scenarios. Each scenario carries its own name, the instructions that shape the email the agent writes, and the business entity it applies to. Scenario-driven configura…
Shared mailbox users and delegates with read and manage (full access) and/or mail folder-level permission will now be able to access Copilot Chat directly from their shared and delegate mailboxes in classic Outlook, when added as a resource.
Quickly get started with modern single-page application (SPA) development by creating a site directly from Power Pages Studio. Continue building and customizing your experience using your preferred development tools and frameworks.
Provide a unified intelligence layer that helps agents discover, reason over, and use organizational knowledge.
Enable agents to use supported REST endpoints as tools through governed Work IQ integrations.
Enable A2A and MCP tasks to request missing information or authorization and then resume.
Enable durable long-running A2A and MCP tasks with progress tracking, later result retrieval, and cancellation.
Enable agents to retrieve relevant Microsoft 365 content and context through Work IQ.
Updated
Users can now use the Teams Meet app to discover events across their organization, track what important events are upcoming, and plan and organize their own professional events. With this release, Meet app will be renamed to Events app.
Copilot in Forms is being enabled for Microsoft Forms in Government Cloud environments, bringing end-to-end AI assistance to forms, from creating a form, to refining and sending to analyzing results. This rollout includes key Copilot features such as: - Draft with Copilot - Distribution and monitoring - Copilot Insights - On-canvas Copilot features such as Rewrite question, Continue writing, Answer explanations, and …
Intelligent recap can now be generated without retaining a transcript after the meeting. Meeting organizers can choose this setting from the meeting options before the meeting, or organizers and eligible participants can enable it during the meeting. After the meeting, the AI Summary will be available, but other elements of the recap may not be available (Chapters, Topics, Mentions, Audio recap).
Microsoft Edge is expanding tab and Workspace organization capabilities to suggest groupings, names, visuals, and labels. Users can manage these experiences through the proposed “Let Microsoft Edge help keep your tabs organized” setting under Privacy, search, and services > Search and connected experiences; administrators can control them using the TabServicesEnabled policy.
Engage is rolling out Custom Branding, a new admin-led capability that lets organizations define a customized, tenant-wide visual identity across the Engage web and mobile apps. Engage-level admins can configure a brand name, add large and small logos, and a theme color that is applied consistently for all users in the tenant. Branding is managed from the new Brand Center in the Viva Engage admin center and helps org…
We are introducing a reimagined SharePoint experience designed to be simple and intuitive, centered on the core jobs of discovering knowledge, publishing content, and building solutions. This update establishes the foundation for AI-assisted creation across the product. This includes an updated information architecture and cohesive design language, delivering a clean and consistent experience across surfaces. Updated…
With a Microsoft 365 Copilot license, transform offline discussions into structured, actionable, and searchable content with voice notes in Copilot.
AI citations analytics will help you track the usage of SP documents, news and pages through copilot and AI agents. You will be able to see how often a page or a file is referenced in a copilot response. You can also get insights into SharePoint site content getting referenced in copilot responses aggregated at the site level.
This feature is a collection of improvements including updates to the auto-save experience for comments, simplifying survey navigation through buttons by consolidating the "Skip" and "Done" buttons into a single "Next" button, and to give the survey taker greater control over question progression by refining the auto-scroll behavior when updating answers to questions.
You will now be able to add multiple steps to your workflow when building one from scratch.
Administrators can choose a severity threshold and receive alerts when a new Edge update includes security fixes that meet or exceed that level, including zero day fixes. This helps organizations quickly identify updates that may require attention, while avoiding unnecessary notifications for routine releases.
The HubSpot connector allows users using the Researcher agent to be able to leverage 3rd party information from HubSpot to enrich generated responses with relevant information.
Copilot Chat can now better match search results from text that appears inside images embedded in Word and PowerPoint files is user's working files — such as scanned contracts in Word, text from tables, text from images — content that was previously difficult to search and find.
Targeted Audience Surveys let change leaders launch a Copilot Pulse survey directly from the Copilot Dashboard to all licensed or active users. Audiences update automatically using Insights data and respect existing dashboard filters like organization and job function, with privacy protected through population-level reporting only. Pair adoption metrics with employee sentiment in just a few clicks.
Alert auto-resolution & tagging rules let you tell DLP, in advance, how to handle predictable alerts. You define a rule once, and from then on DLP applies it automatically to every new alert: ● Resolve alerts you don't need to see - e.g., Low-severity alerts for mail sent only to your trusted partner domains, so they never reach your triage queue. ● Tag alerts so you can find and route them - e.g., label every al…
With the introduction of file archiving support in SharePoint Online, administrators are looking to seamlessly include archiving actions within their existing data retention policies. This means that, in addition to keeping or deleting data, admins want to now leverage Purview DLM to archive files according to organizational requirements, ensuring comprehensive governance across all stages of the content lifecycle in…
When files are opened in Windows, the operating system, and applications (for example, Microsoft Office and browsers) can create, rename, and delete temporary files as part of normal behavior. The Endpoint client audits these activities, resulting in high-volume, low-signal events that appear as “noise” for Insider Risk Management (IRM) customers. While global exclusions exist (file type, keyword, file path, etc.), s…
We are introducing file archiving support in SharePoint Online, utilizing this feature administrators can seamlessly include archiving actions within their existing data retention policies. This means that, in addition to keeping or deleting data, admins can now leverage Purview DLM to archive files according to organizational requirements, ensuring comprehensive governance across all stages of the content lifecycle …
With this update, Risky AI usage policy template will support priority content. Customers can define Sensitive Info Types (SITs), Trainable Classifiers, Sensitivity Labels as priority content, and get alerted only when the activity matches the selected priority content. Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, …
Stay connected to your team’s engagement with Viva Insights Workplace Metrics, available alongside your survey results in Viva Glint. Between survey cycles, leaders and managers can use these continuous, real-time metrics to see how their team is working and evaluate whether actions they are taking to improve engagement are having the desired impact. This feature currently supports work-life balance and collaboration…
We are introducing a more streamlined messaging experience that displays more content on screen while improving readability when using Teams on mobile. These updates make it easier to scan conversations and follow the discussion flow, helping users stay productive and engaged wherever they work.
Search, chat, and explore the web from one search box with Copilot-suggested actions and curated work content to help your users get things done faster on the Copilot new tab page. Users will see upgraded Copilot new tab page functionality and features.
The Microsoft Rights Management (RMS) connector is moving from shared-secret authentication to certificate-based authentication, improving its security posture. With this update, administrators configure their own Microsoft Entra app registration and certificate, then use the new PowerShell module to configure the certificate for each workload (Connector, Exchange, SharePoint, and FCI). New PowerShell cmdlets handle …
Users can now upload videos directly into a Teams event or meeting from OneDrive from the "Manage view" options when an organizer has turned on Manage What Attendees See mode. This ensures a smoother high quality video playback with a more consistent experience for attendees.
AI agent skill to detect and alert unhealthy policy sync and device configuration.
This feature is bringing the Information Protection Filer Labeler and Viewer applications to the MacOS platform. Enabling customers to have the same capabilities available on Mac. Core functionality will be available with the exception of the Advanced label-based protection feature.
Teams will store AI-generated meeting memory files for meetings where Intelligent Recap was turned on, allowing Copilot (and Facilitator) to retain key insights from meetings beyond transcript retention periods and when a transcript was not saved. This enables Copilot to continue answering questions about past meetings even after the transcript expires or the meeting is over. Admins can also configure how long this A…
This creates the ability to apply Retention to each SharePoint or OneDrive item based on when it was last accessed by a user. #copilotcontrolsystem
Quickly find your files and leverage Copilot to get a better understanding within the search tab on the go. This item is no longer accurate and is being removed from the roadmap. We apologize for the inconvenience.
Microsoft blogs 3 All posts
Newly announced retirements 3 View all
Security advisories 187 / 1 All advisories
New
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Office Online Server: KB5002928
Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Office Online Server: KB5002928
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Office Online Server: KB5002928
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Office Online Server: KB5002928
16.0.10417.20228
Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 9.8 out of 10: critical. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 9.8 out of 10: critical. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.5 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 8.1 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 9.8 out of 10: critical. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 9.8 out of 10: critical. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 8.1 out of 10: high. Microsoft rates it Critical.
- No attacks reported yet, but Microsoft expects exploitation to be likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Exchange Server Subscription Edition RTM: KB5128895
15.02.2562.056 - Microsoft Exchange Server 2019 Cumulative Update 15: KB5128896
15.02.1748.055 - Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897
15.02.1544.050 - Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898
15.01.2507.077
- Microsoft Exchange Server Subscription Edition RTM: KB5128895
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 9.8 out of 10: critical. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 9.8 out of 10: critical. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 8.1 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 9.8 out of 10: critical. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 8.1 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Microsoft heeft kwetsbaarheden verholpen in de Configuration Manager en Defender. Een lokale kwaadwillende kan de kwetsbaarheden misbruiken om zich verhoogde rechten toe te kennen en mogelijk toegang te krijgen tot gevoelige gegevens.
Microsoft Configuration Manager: |------------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |------------------|------|-------------------------------------| | CVE-2026-88075 | 8.80 | Verkrijgen van verhoogde rechten | |------------------|------|-------------------------------------|
What does this mean?
- NCSC rates the likelihood of abuse as medium and the possible impact as high.
- 3 vulnerabilities. See "Show CVE information" for each CVE.
- Affects: Microsoft Configuration Manager 2503, Microsoft Configuration Manager 2509, Microsoft Configuration Manager 2603, Microsoft Configuration Manager 2603 on .NET Core 2.1, Microsoft Defender for Endpoint for Linux, Windows Defender.
- What should you do? Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Microsoft heeft kwetsbaarheden verholpen in diverse Dynamics componenten. Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de categorieën schade zoals benoemd in onderstaande tabellen:
Microsoft Dataverse: |------------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |------------------|------|-------------------------------------| | CVE-2026-88131 | 9.80 | Uitvoeren van willekeurige code | |------------------|------|-------------------------------------|
What does this mean?
- NCSC rates the likelihood of abuse as medium and the possible impact as high.
- 6 vulnerabilities, highest CVSS 9.8. See "Show CVE information" for each CVE.
- Affects: Microsoft Dataverse, Microsoft Dynamics 365 (on-premises) version 9.1, Microsoft Dynamics NAV 2017 on Windows Server 2012, Microsoft Dynamics NAV 2018 on Windows Server 2012.
- What should you do? Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Microsoft heeft xxx kwetsbaarheden verholpen in diverse Office producten, zoals Word, Excel, Access, Outlook, Visio, Sharepoint en PowerPoint, maar ook subcomponenten als Shell, Azure Key Vault en Click-to-Run. Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zich verhoogde rechten toe te kennen, willekeurige code uit te voeren en toegang te krijgen tot gevoelige informatie in de context van het slachtoffer.
Voor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden een malafide bestand te openen of link te volgen.
What does this mean?
- NCSC rates the likelihood of abuse as medium and the possible impact as high.
- 40 vulnerabilities. See "Show CVE information" for each CVE.
- Affects: Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 for 32-bit editions, Microsoft Office LTSC 2021 for 64-bit editions, Microsoft Office LTSC 2024 for 32-bit editions ….
- What should you do? Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Microsoft heeft kwetsbaarheden verholpen in Exchange. Een kwaadwillende kan de kwetsbaarheden misbruiken om zich voor te doen als andere gebruiker, zich verhoogde rechten toe te kennen en willekeurige code uit te voeren met rechten van het proces.
Van de kwetsbaarheid met kenmerk CVE-2026-96940 is eerder al een out-of-band update verschenen, maar is ook opgenomen in deze cumulatieve update.
What does this mean?
- NCSC rates the likelihood of abuse as medium and the possible impact as high.
- 7 vulnerabilities, highest CVSS 8.8. See "Show CVE information" for each CVE.
- Affects: Exchange, Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 15, Microsoft Exchange Server Subscription Edition RTM.
- What should you do? Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
- Spoofing. An attacker can pretend to be another user or source, for example through a misleading link or page.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.1 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server 2019
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.
What does this mean?
- Tampering. An attacker can change data or settings without permission.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 6.8 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 7.0 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBClick to Run
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBClick to Run
https://aka.ms/OfficeSecurityReleases
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBClick to Run
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office 365 for Mac: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Office Online Server: KB5002928
16.0.10417.20228
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Office Online Server: KB5002928
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 5.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
Use after free in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 5.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Buffer underwrite ('buffer underflow') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Office Online Server: KB5002928
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 5.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
What does this mean?
- Security Feature Bypass. An attacker can get around a security feature.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
- Spoofing. An attacker can pretend to be another user or source, for example through a misleading link or page.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
- CVSS 4.6 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
- Spoofing. An attacker can pretend to be another user or source, for example through a misleading link or page.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
- CVSS 4.6 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 7.5 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
- Spoofing. An attacker can pretend to be another user or source, for example through a misleading link or page.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
- CVSS 7.3 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 7.5 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898
15.01.2507.077 - Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897
15.02.1544.050 - Microsoft Exchange Server Subscription Edition RTM: KB5128895
15.02.2562.056 - Microsoft Exchange Server 2019 Cumulative Update 15: KB5128896
15.02.1748.055
- Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898
Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897
15.02.1544.050 - Microsoft Exchange Server Subscription Edition RTM: KB5128895
15.02.2562.056 - Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898
15.01.2507.077 - Microsoft Exchange Server 2019 Cumulative Update 15: KB5128896
15.02.1748.055
- Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897
15.02.1544.050 - Microsoft Exchange Server Subscription Edition RTM: KB5128895
15.02.2562.056 - Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898
15.01.2507.077
- Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited with access to the device itself, without an account and without any user action.
- CVSS 6.2 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Windows 11 Version 24H2 for x64-based Systems: KB5127648
10.0.26100.9711 - Windows 11 Version 25H2 for x64-based Systems: KB5127648
10.0.26200.9711 - Windows 11 Version 26H1 for ARM64-based Systems: KB5127646
10.0.28000.3231 - Windows 11 version 26H1 for x64-based Systems: KB5127646
10.0.28000.3231 - Windows 11 Version 24H2 for ARM64-based Systems: KB5127648
10.0.26100.9711 - Windows Server 2025: KB5126646
10.0.26100.33650
- Windows 11 Version 24H2 for x64-based Systems: KB5127648
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Skype for Business Server Subscription Edition RTM: KBRelease Notes
7.0.2046.889 - Skype for Business Server 2015 CU13: KB5132779
6.0.9319.886 - Skype for Business Server 2019 CU8: KB5131693
7.0.2046.583 - Skype for Business Server Subscription Edition CU1: KB5131692
7.0.2046.889
- Skype for Business Server Subscription Edition RTM: KBRelease Notes
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.1 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Skype for Business Server 2015 CU13: KB5132779
6.0.9319.886 - Skype for Business Server 2019 CU8: KB5131693
7.0.2046.583 - Skype for Business Server Subscription Edition CU1: KB5131692
7.0.2046.889
- Skype for Business Server 2015 CU13: KB5132779
Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898
15.01.2507.077 - Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897
15.02.1544.050 - Microsoft Exchange Server 2019 Cumulative Update 15: KB5128896
15.02.1748.055 - Microsoft Exchange Server Subscription Edition RTM: KB5128895
15.02.2562.056
- Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Skype for Business Server 2019 CU8: KB5131693
7.0.2046.583 - Skype for Business Server 2015 CU13: KB5132779
6.0.9319.886 - Skype for Business Server Subscription Edition CU1: KB5131692
7.0.2046.889
- Skype for Business Server 2019 CU8: KB5131693
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 7.5 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
- Spoofing. An attacker can pretend to be another user or source, for example through a misleading link or page.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 9.3 out of 10: critical. Microsoft rates it Important.
- No attacks reported yet, but Microsoft expects exploitation to be likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898
15.01.2507.077 - Microsoft Exchange Server 2019 Cumulative Update 15: KB5128896
15.02.1748.055 - Microsoft Exchange Server Subscription Edition RTM: KB5128895
15.02.2562.056 - Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897
15.02.1544.050
- Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 7.0 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), only with admin rights and without any user action.
- CVSS 7.2 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 7.5 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), only with admin rights and without any user action.
- CVSS 4.9 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 5.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
- CVSS 8.0 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Power Apps
2608.5 - Microsoft Power Apps for Android: KBRelease Notes
3.26085.7
- Microsoft Power Apps
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 7.5 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190 - Microsoft SharePoint Server 2019
- Microsoft SharePoint Enterprise Server 2016
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.20934 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20878 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20878 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.20934 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 4.3 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper input validation in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.5 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.5 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over an adjacent network.
What does this mean?
- Spoofing. An attacker can pretend to be another user or source, for example through a misleading link or page.
- It can be exploited from the same local network, with an ordinary user account and without any user action.
- CVSS 5.7 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.5 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.5 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 7.4 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
- Spoofing. An attacker can pretend to be another user or source, for example through a misleading link or page.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
- CVSS 4.6 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
- Spoofing. An attacker can pretend to be another user or source, for example through a misleading link or page.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
- CVSS 4.6 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Defender for Endpoint for Linux
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Updated
Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 8.6 out of 10: high. Microsoft rates it Critical.
- What should you do? Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Mon 12 Oct 2026
19 new · 25 updatedM365 Status 5 / 2 Summary
New
User impact
Users' Microsoft Teams contact cards may not fully display Out of office text.
Current status
We've identified that a recent service change to the Microsoft Teams contact cards introduced a code regression in which the user interface (UI) of the Out of office text contains an invalid value and is causing impact. We're deploying a fix to correct the value and remediate the impact. We'll provide a timeline for the completion of the deployment as one becomes available.
Scope of impact
Any user attempting to view Out of office text on Microsoft Teams contact cards may be impacted.
Root cause
A recent service change to the Microsoft Teams contact cards introduced a code regression in which the user interface (UI) of the Out of office text contains an invalid value and is causing impact.
Next steps
Monday, October 19, 2026, at 9:00 PM UTC
More info
Selecting “See more” may not display the full Out of office message. Users may hover over the message to see the full text in a tool tip.
Updates
- We've identified that a recent service change to the Microsoft Teams contact cards introduced a code regression in which the user interface (UI) of the Out of office text contains an invalid value and is causing impact. We're deploying a fix to correct the value and remediate the impact. We'll provide a timeline for the completion of the deployment as one becomes available.
- We're reviewing the screenshots provided by a subset of affected users to gain clarity on the issue and determine the next steps to isolate the root cause.
- We're investigating a potential issue with Microsoft Teams and checking for impact to your organization. We'll provide an update within 30 minutes.
Next update by: Monday, October 19, 2026, at 9:00 PM UTC
User impact
Admins may have been unable to review Service health or Message center postings in the Microsoft 365 admin center.
Current status
We're continuing to monitor recovery, and we anticipate some users will start to see remediation at this time. To ensure impact is fully remediated, we've extended our monitoring period, and we anticipate impact to be resolved by our next scheduled update.
Scope of impact
This issue affected some admins attempting to review Service health or Message center postings in the Microsoft 365 admin center or see new activities in the “What’s new” tab in the Microsoft Teams admin center. Start time: Monday, October 12, 2026, at 9:54 PM UTC End time: Tuesday, October 13, 2026, at 7:35 PM UTC
Root cause
A recent service update introduced a misconfiguration which caused the Service Health and Communications API to return authentication errors, resulting in impact. Next steps: - We're analyzing the offending service update to determine why the potential for impact wasn't caught during our internal update testing and validation phases. This further analysis will help us to improve our update implementation processes moving forward to ensure similar impact scenarios don't occur in the future. This is the final update for the event.
Next steps
Tuesday, October 13, 2026, at 10:00 PM UTC
More info
Admins' "What's new" tab in the Microsoft Teams admin center may have been blank and displayed an error stating, "We can't load data. Try again." Final status: We've completed our monitoring period and validated that the rollback of the service update containing the misconfiguration successfully remediated impact.
Updates
- Title: Admins may be unable to review Service health or Message center postings in the Microsoft 365 admin center User impact: Admins may have been unable to review Service health or Message center postings in the Microsoft 365 admin center. More info: Admins' "What's new" tab in the Microsoft Teams admin center may have been blank and displayed an error stating, "We can't load data. Try again." Final status: We've completed our monitoring period and validated that the rollback of the service update containing the misconfiguration successfully remediated impact. Scope of impact: This issue affected some admins attempting to review Service health or Message center postings in the Microsoft 365 admin center or see new activities in the “What’s new” tab in the Microsoft Teams admin center. Start time: Monday, October 12, 2026, at 9:54 PM UTC End time: Tuesday, October 13, 2026, at 7:35 PM UTC Root cause: A recent service update introduced a misconfiguration which caused the Service Health and Communications API to return authentication errors, resulting in impact. Next steps: - We're analyzing the offending service update to determine why the potential for impact wasn't caught during our internal update testing and validation phases. This further analysis will help us to improve our update implementation processes moving forward to ensure similar impact scenarios don't occur in the future. This is the final update for the event.
- We're continuing to monitor recovery, and we anticipate some users will start to see remediation at this time. To ensure impact is fully remediated, we've extended our monitoring period, and we anticipate impact to be resolved by our next scheduled update.
- We've received reports from a subset of affected users who have reported that they are unable to review Service health or Message center postings in the Microsoft 365 admin center or see new activities in the “What’s new” tab in the Microsoft Teams admin center. We've isolated that a recent service update introduced a misconfiguration which causes the Service Health and Communications API to return authentication errors, resulting in impact. We're rolling back the offending update and monitoring for remediation. We anticipate impact to be resolved by our next scheduled update.
- We're investigating a potential issue with the Microsoft 365 suite and checking for impact to your organization. We'll provide an update within 30 minutes.
Next update by: Tuesday, October 13, 2026, at 10:00 PM UTC
User impact
Admins are unable to access the EAC.
Current status
Our testing has identified a recent Exchange admin center (EAC) configuration change as a potential contributor to the access failures and associated HTTP 302 redirects. We’re rolling back the change, which we expect to complete within approximately two hours. Once complete, we’ll monitor the environment to determine whether this resolves the impact.
Scope of impact
Impact was specific to admins attempting to access the EAC. Start time: Monday, October 12, 2026, at 8:15 AM UTC End time: Monday, October 12, 2026, at 12:50 PM UTC Preliminary root cause: A recent EAC configuration change resulted in unexpected HTTP responses within the affected request path, preventing admins from successfully accessing the EAC. Reverting the identified change restored expected service functionality. Next steps: - We’re reviewing the identified EAC change and associated service configuration to help prevent similar impact from recurring. - We’re reviewing our monitoring and telemetry to improve detection and alerting for similar service behavior. We’ll provide a preliminary Post-Incident Report within two business days and a final Post-Incident Report within five business days.
Next steps
Monday, October 12, 2026, at 1:30 PM UTC
More info
When attempting to access the Exchange admin center, affected admins encountered an “Internal Server Error” message. Final status: We've completed the rollback of the identified Exchange admin center (EAC) change. Service telemetry shows that errors have returned to expected levels, and user reports have confirmed that EAC access has been restored. Admins who continue to experience impact should close their existing EAC browser session, open a new session, and retry accessing the EAC. We’ll continue to monitor service health to ensure sustained service stability.
Updates
- A post-incident report has been published.
- A post-incident report has been published.
- Title: Admins are unable to access the Exchange admin center (EAC) User impact: Admins are unable to access the EAC. More info: When attempting to access the Exchange admin center, affected admins encountered an “Internal Server Error” message. Final status: We've completed the rollback of the identified Exchange admin center (EAC) change. Service telemetry shows that errors have returned to expected levels, and user reports have confirmed that EAC access has been restored. Admins who continue to experience impact should close their existing EAC browser session, open a new session, and retry accessing the EAC. We’ll continue to monitor service health to ensure sustained service stability. Scope of impact: Impact was specific to admins attempting to access the EAC. Start time: Monday, October 12, 2026, at 8:15 AM UTC End time: Monday, October 12, 2026, at 12:50 PM UTC Preliminary root cause: A recent EAC configuration change resulted in unexpected HTTP responses within the affected request path, preventing admins from successfully accessing the EAC. Reverting the identified change restored expected service functionality. Next steps: - We’re reviewing the identified EAC change and associated service configuration to help prevent similar impact from recurring. - We’re reviewing our monitoring and telemetry to improve detection and alerting for similar service behavior. We’ll provide a preliminary Post-Incident Report within two business days and a final Post-Incident Report within five business days.
- We’ve completed the rollback and are continuing to monitor service health, with telemetry showing errors trending downward from their earlier peak. Admins who continue to experience impact should close their existing Exchange admin center (EAC) browser session, open a new session, and retry accessing the EAC. We’ll continue monitoring to validate recovery. This quick update is designed to give the latest information on this issue. Next update by: Monday, October 12, 2026, at 1:30 PM UTC
- We’re continuing to roll back the identified Exchange admin center (EAC) change. Initial telemetry shows errors trending downward from their earlier peak, and we’re monitoring service health to determine whether the rollback restores access for affected admins. This quick update is designed to give the latest information on this issue. Next update by: Monday, October 12, 2026, at 1:30 PM UTC
- Our testing has identified a recent Exchange admin center (EAC) configuration change as a potential contributor to the access failures and associated HTTP 302 redirects. We’re rolling back the change, which we expect to complete within approximately two hours. Once complete, we’ll monitor the environment to determine whether this resolves the impact.
- We’re continuing to test the rollback of the recent Exchange admin center (EAC) change while monitoring the results to determine if this resolves the impact. In parallel, we’re continuing our analysis of the unexpected HTTP 302 redirects to help determine the source of the issue. This quick update is designed to give the latest information on this issue. Next update by: Monday, October 12, 2026, at 12:30 AM UTC
- We’re continuing to investigate the unexpected HTTP 302 redirects and are testing a rollback of a recent Exchange admin center (EAC) change to determine if this resolves the impact. We’re also comparing results across affected environments to determine our next steps.
Next update by: Monday, October 12, 2026, at 1:30 PM UTC
User impact
Users may have been unable to access or protect content using ARM in Microsoft 365 services.
Current status
We’ve redirected traffic away from affected infrastructure to allow the unhealthy service components to recover. Following this action, we’ve observed service recovery across all affected regions. We’re monitoring service health to confirm that recovery remains stable while we continue investigating the root cause.
Scope of impact
Some users attempting to encrypt, decrypt, open, upload, or download protected content across Microsoft 365 services that rely on ARM, including Microsoft Purview and Power BI, or publish agents or add skills to existing agents in Microsoft 365 Copilot Chat, may have been impacted. Start time: Monday, October 12, 2026, at 7:00 AM UTC End time: Monday, October 12, 2026, at 10:21 AM UTC
Root cause
A section of the ARM service infrastructure that facilitates the processing of cached service data was underperforming, resulting in impact. Next steps: - We’re reviewing performance data and trends on the affected infrastructure to help prevent similar impact from happening again.
Next steps
Monday, October 12, 2026, at 12:30 PM UTC
More info
Impact may have prevented users from encrypting, decrypting, or opening protected files and email messages across Microsoft 365 services that rely on ARM. This included protection capabilities in Microsoft Purview, encrypted documents, protected file uploads and downloads in SharePoint Online, related Power BI and dependent service functionality, and publishing agents or adding skills to existing agents in Microsoft 365 Copilot Chat. Final status: We’ve determined that a section of the ARM service infrastructure that facilitates the processing of cached service data was underperforming, resulting in impact. We’ve confirmed, following a period of monitoring service telemetry, that the mitigating actions successfully resolved the issue.
Updates
- Title: Users may have been unable to access or protect content using Azure Rights Management (ARM) in Microsoft 365 services User impact: Users may have been unable to access or protect content using ARM in Microsoft 365 services. More info: Impact may have prevented users from encrypting, decrypting, or opening protected files and email messages across Microsoft 365 services that rely on ARM. This included protection capabilities in Microsoft Purview, encrypted documents, protected file uploads and downloads in SharePoint Online, related Power BI and dependent service functionality, and publishing agents or adding skills to existing agents in Microsoft 365 Copilot Chat. Final status: We’ve determined that a section of the ARM service infrastructure that facilitates the processing of cached service data was underperforming, resulting in impact. We’ve confirmed, following a period of monitoring service telemetry, that the mitigating actions successfully resolved the issue. Scope of impact: Some users attempting to encrypt, decrypt, open, upload, or download protected content across Microsoft 365 services that rely on ARM, including Microsoft Purview and Power BI, or publish agents or add skills to existing agents in Microsoft 365 Copilot Chat, may have been impacted. Start time: Monday, October 12, 2026, at 7:00 AM UTC End time: Monday, October 12, 2026, at 10:21 AM UTC Root cause: A section of the ARM service infrastructure that facilitates the processing of cached service data was underperforming, resulting in impact. Next steps: - We’re reviewing performance data and trends on the affected infrastructure to help prevent similar impact from happening again.
- We’ve redirected traffic away from affected infrastructure to allow the unhealthy service components to recover. Following this action, we’ve observed service recovery across all affected regions. We’re monitoring service health to confirm that recovery remains stable while we continue investigating the root cause.
- We’ve identified that some service components responsible for processing ARM requests are in an unhealthy state. We’re attempting to restart the affected components to mitigate impact. We’re seeing early signs of service recovery and are investigating the root cause while evaluating whether additional mitigation actions are required.
Next update by: Monday, October 12, 2026, at 12:30 PM UTC
User impact
Users may have been unable to view or modify custom forms in SharePoint Online.
Current status
We're continuing to deploy our fix to the affected environments and anticipate that deployment will be completed within 48 hours. We'll provide the latest deployment progress and updated completion timeline in our next update.
Scope of impact
This issue may have impacted any user attempting to view or modify Nintex or SPFx Customizers forms in SharePoint Online. Start time: Monday, October 12, 2026, at 1:00 AM UTC End time: Wednesday, October 14, 2026, at 5:52 PM UTC
Root cause
A recent API change to the SharePoint Online infrastructure introduced an incompatibility in how requests from custom forms are processed, resulting in impact. Next steps: - We're reviewing our testing and validation procedures to help prevent similar impact in the future. We'll provide a preliminary Post-Incident Report within two business days and a final Post-Incident Report within five business days.
Next steps
Wednesday, October 14, 2026, at 6:00 PM UTC
More info
Affected users may have encountered multiple potential scenarios with Nintex and SharePoint Framework (SPFx) Customizers forms, including: - Blank pages - Null target exceptions Final status: We've completed deployment of the fix to all affected environments, and we've confirmed with impacted organizations that the issue is no longer occurring.
Updates
- Title: Users may be unable to view or modify custom forms in SharePoint Online User impact: Users may have been unable to view or modify custom forms in SharePoint Online. More info: Affected users may have encountered multiple potential scenarios with Nintex and SharePoint Framework (SPFx) Customizers forms, including: - Blank pages - Null target exceptions Final status: We've completed deployment of the fix to all affected environments, and we've confirmed with impacted organizations that the issue is no longer occurring. Scope of impact: This issue may have impacted any user attempting to view or modify Nintex or SPFx Customizers forms in SharePoint Online. Start time: Monday, October 12, 2026, at 1:00 AM UTC End time: Wednesday, October 14, 2026, at 5:52 PM UTC Root cause: A recent API change to the SharePoint Online infrastructure introduced an incompatibility in how requests from custom forms are processed, resulting in impact. Next steps: - We're reviewing our testing and validation procedures to help prevent similar impact in the future. We'll provide a preliminary Post-Incident Report within two business days and a final Post-Incident Report within five business days.
- We're continuing to deploy our fix to the affected environments and anticipate that deployment will be completed within 48 hours. We'll provide the latest deployment progress and updated completion timeline in our next update.
- We've confirmed a recent API change as the source of the impact and have prevented it from reaching any further environments. We're continuing to deploy our fix to the affected environments to remediate the impact.
- We’ve isolated a recent API change as the suspected source of the impact. We’ve initiated the process of deploying a fix to confirm our findings and potentially remediate the impact.
- We're continuing our analysis of the HAR captures to determine the cause of impact.
- We're expanding our investigation to include HTTP Archive format (HAR) browser captures of the issue in progress to assist in isolating the underlying cause of impact and develop a remediation strategy.
- We're reviewing support case details to better understand the impact scenario and determine our next steps.
- We're investigating a potential issue with SharePoint Online and checking for impact to your organization. We'll provide an update within 30 minutes.
Next update by: Wednesday, October 14, 2026, at 6:00 PM UTC
Updated
User impact
Users may intermittently be unable to access their calendars in Outlook on the web and the new Outlook desktop client.
Current status
We’ve completed deployment of the fix to the initially affected service environment and expect this has remediated impact for users in that environment. The fix is continuing to propagate across the remaining affected environment, with this process expected to take approximately one additional week to complete. We’ll continue monitoring the deployment as it progresses to confirm that impact is fully remediated.
Scope of impact
Some users attempting to access their calendars through Outlook on the web or the new Outlook desktop client may intermittently be impacted. Start time: Tuesday, July 7, 2026, at 5:33 PM UTC
Root cause
The issue is related to the calendar cache state following a refresh, where the event-loading process may continue referencing outdated calendar data after the folder information is updated.
Next steps
Monday, October 19, 2026, at 10:00 AM UTC
More info
Impacted users may receive the following error message: “Can’t retrieve calendar events right now. Refresh the browser and try again.” As a workaround, impacted users can access their calendar in the classic Outlook desktop client.
Updates
- We’ve completed deployment of the fix to the initially affected service environment and expect this has remediated impact for users in that environment. The fix is continuing to propagate across the remaining affected environment, with this process expected to take approximately one additional week to complete. We’ll continue monitoring the deployment as it progresses to confirm that impact is fully remediated.
- Our fix deployment is completing for the initially identified service environment; however, we’ve confirmed that additional environments remain impacted. While some users should experience impact resolution as the fix reaches them, we’re extending the fix deployment to the remaining affected environments, and we’ll provide an estimation for its completion once available.
- Our fix deployment is completing and we're reaching out to some users to confirm the issue is no longer occurring.
- We’ve identified that the issue is related to the calendar cache state following a refresh, where the event-loading process may continue referencing outdated calendar data after the folder information is updated. We’ve implemented and merged a fix to ensure the refreshed calendar data is correctly used when loading subsequent events. The fix is expected to reach affected users by October 9, 2026.
- We’re continuing to review service health telemetry and HAR logs to investigate what we suspect is a caching issue that’s leading to the impact. We’re also testing potential solutions to confirm our findings and determine our next steps.
- Our review of service health telemetry and the HAR logs persists as we continue to isolate the source of this issue.
- We're currently reviewing telemetry and HTTP Archive format (HAR) log information as we investigate the cause of impact.
- We're investigating a potential issue with Exchange Online and checking for impact to your organization. We'll provide an update within 30 minutes.
Next update by: Monday, October 19, 2026, at 10:00 AM UTC
User impact
Admins may have received failures creating or updating Communications Compliance policies in Microsoft Purview.
Current status
We've completed the deployment to over 90 percent of the affected infrastructure. While most admins should see relief, we expect the release to complete by the next scheduled update.
Scope of impact
Some admins may have received failures when they created or updated Communications Compliance policies in Microsoft Purview with more than four classifiers. Start time: Monday, July 6, 2026, at 12:00 AM UTC End time: Friday, October 9, 2026, at 6:00 PM UTC
Root cause
A service update which intended to add operations with larger data sizes introduced a code error, causing size limitation issues. Next steps: We're reviewing and improving our service update validation procedure to prevent similar issues from occurring again in the future. This is the final update for this event.
Next steps
Monday, October 12, 2026, at 6:00 PM UTC
More info
Impact was limited to Communications Compliance policies with more than four classifiers. Final status: The fix deployed to the whole of the affected infrastructure, and we've confirmed with our internal monitoring telemetry that impact is remediated.
Updates
- Title: Some admins may receive failures creating or updating Communications Compliance policies in Microsoft Purview User impact: Admins may have received failures creating or updating Communications Compliance policies in Microsoft Purview. More info: Impact was limited to Communications Compliance policies with more than four classifiers. Final status: The fix deployed to the whole of the affected infrastructure, and we've confirmed with our internal monitoring telemetry that impact is remediated. Scope of impact: Some admins may have received failures when they created or updated Communications Compliance policies in Microsoft Purview with more than four classifiers. Start time: Monday, July 6, 2026, at 12:00 AM UTC End time: Friday, October 9, 2026, at 6:00 PM UTC Root cause: A service update which intended to add operations with larger data sizes introduced a code error, causing size limitation issues. Next steps: We're reviewing and improving our service update validation procedure to prevent similar issues from occurring again in the future. This is the final update for this event.
- We've completed the deployment to over 90 percent of the affected infrastructure. While most admins should see relief, we expect the release to complete by the next scheduled update.
- We've continuing to monitor the deployment of our fix which remains scheduled to complete by Monday, October 5, 2026.
- We've completed internal validations for our solution and have begun its deployment. Our fix deployment timeline projects the deployment will remediate the impact by Monday, October 5, 2026. Until this time, we advise users to keep Communications Compliance policies limited to under four classifiers in order to avoid impact.
- We've received reports from a subset of affected admins who have reported receiving size limitation failures when creating or updating Communications Compliance policies in Microsoft Purview. We've isolated that a recent update introduced operations with larger data size included a code issue, causing size limitation issues. We've created a code fix to address the issue, which we anticipate being fully deployed by Monday, October 5, 2026. During this time, we advise users to keep Communications Compliance policies limited to under four classifiers in order to avoid impact.
- We're investigating a potential issue with Microsoft Purview and checking for impact to your organization. We'll provide an update within 30 minutes.
Next update by: Monday, October 12, 2026, at 6:00 PM UTC
Message Center 5 / 7 Summary
New
What and why
Apps in Copilot Cowork are now available through the Frontier program, and Apps in Microsoft Copilot Studio are rolling out in public preview.To provide a unified experience for building apps with natural language, Microsoft is retiring the App Builder agent in Microsoft 365 Copilot and vibe.powerapps.com.
Copilot Cowork and Microsoft Copilot Studio will become the primary experiences for creating apps using natural language. This retirement helps consolidate app creation experiences and provides makers with a consistent path forward for building and managing apps.
What and why
We are updating the Brand Center setup experience so that administrators can set up Brand Center without enabling Public CDN.
Today, Public CDN is enabled as part of Brand Center setup, even when an organization only wants to use branding governance capabilities that do not require it. With this update, organizations can begin using Brand Center while deferring Public CDN until they need capabilities that depend on it, such as organizational fonts.
What and why
Users of new Outlook for Windows and Outlook on the web will be able to create inbox rules that automatically reply to incoming messages using a saved template. This helps users reduce repetitive work while providing faster, more consistent responses. This change supports personal and team productivity by automating routine email responses.
This message is associated with Microsoft 365 Roadmap ID 567318.
What and why
The Microsoft Graph AuditLogQuery API is generally available for programmatic access to Microsoft Purview Audit activity logs. We are also announcing the planned retirement of the Search-UnifiedAuditLog PowerShell cmdlet on October 15, 2027.
The AuditLogQuery API provides improved scalability and reliability, more granular workload-level permissions, and support for exporting up to 1 million audit records per query. As audit data volumes and automation scenarios have grown, Search-UnifiedAuditLog has reached scalability limitations that can affect reliability and performance for large-volume searches. Future investments and enhancements for audit search will focus on the AuditLogQuery API.
Sales Premium delivers the Sales Insights capabilities at the same price as the Sales Enterprise + Sales Insights combination. It also includes Copilot Credits, additional Dataverse storage capacity, and access to new Sales Premium capabilities. This change is intended to reduce licensing complexity.
How does this affect me?
Existing Sales Insights customers will retain access through the end of their current contract term, with no immediate disruption from this retirement.
At renewal, the Sales Insights add-on will no longer be available. Customers who want to continue using Sales Insights capabilities should transition to Dynamics 365 Sales Premium. Customers who do not need those capabilities may continue with Dynamics 365 Sales Enterprise.
What action do I need to take?
To prepare for this change:
Updated
Updated October 12, 2026: We have updated the content. Thank you for your patience.
What and why
Microsoft Teams is introducing AI generated meeting memory files that capture key insights from meetings (formerly archive files). These files help Microsoft 365 Copilot and Facilitator deliver more accurate context aware responses while maintaining strong privacy controls by not storing raw meeting content. This capability supports enterprise ready AI by improving knowledge grounding while keeping data secure and manageable.
This message is associated with Microsoft 365 Roadmap ID 558933.
Updated October 12, 2026: We have decided not to move forward with this change at this time. We apologize for any inconvenience.
Introduction
To improve reliability, compliance, and collaboration, we’re updating where Microsoft Whiteboard files created from a Teams Channel tab are stored. Previously, these whiteboards were saved in the OneDrive of the user who created them, which could lead to access issues due to sharing settings, Information Barriers, or Conditional Access policies.
With this update, whiteboards created from Teams Channels will be stored in the associated SharePoint site for the channel, aligning Whiteboard with the storage behavior of other Microsoft 365 apps and ensuring consistent access for all channel members.
Updated October 12, 2026: We have updated the timeline. Thank you for your patience.
Introduction
We are introducing a new capability that allows users to connect Microsoft Teams meetings to existing Microsoft Planner plans.
Currently, Teams meetings automatically create separate Planner plans for meeting-related tasks, which can result in tasks for the same initiative being spread across multiple plans. This update enables users to link meetings to an existing plan so tasks can be tracked in a single location, improving organization and continuity across ongoing work.
This message is associated with Roadmap ID 561490.
Updated October 1, 2026: We have updated the content and timeline. Thank you for your patience.
What it is
Microsoft is rolling out a new feature to streamline how app and agent availability and installation is managed across Teams, Outlook, and Microsoft 365 Copilot. Until now, IT admins configured availability and installation settings separately in both the Microsoft 365 Admin Center (MAC) and the Teams Admin Center (TAC), which led to mismatches. With this update, you’ll be able to unify availability and installation policies for apps and agents across both portals, making app management more consistent and efficient.
This message is associated with Microsoft 365 Roadmap ID 393931, 485712 and 503105.
Updated October 12, 2026: We have updated the timeline. Thank you for your patience.
What and why
Microsoft Purview Data Lifecycle Management now allows admins to archive SharePoint files based on retention policies. This helps organizations reduce storage costs by moving inactive content to Microsoft 365 Archive while maintaining compliance and discoverability. Archived content is excluded from Copilot indexing, which can improve the relevance of Copilot responses by focusing results on current, active data.
Updated October 12, 2026: We have updated the timeline. Thank you for your patience.
What and why
Microsoft Purview Data Lifecycle Management is introducing the ability to archive SharePoint files based on retention policies. This feature helps organizations reduce storage costs by moving inactive content to Microsoft 365 Archive while maintaining compliance and discoverability. By excluding archived content from Copilot indexing, organizations can also improve the relevance and quality of Copilot responses, ensuring users focus on current, active data.
This message is associated with Microsoft 365 Roadmap ID 561208.
What and why
We are introducing Full Workload Backup for Microsoft 365 Backup, a new capability that allows admins to quickly protect an entire workload (SharePoint, OneDrive, or Exchange) with a single policy. This feature automatically includes all existing and newly created artifacts that are not already covered by custom policies, helping organizations improve data protection coverage, reduce administrative overhead, and ensure continuous backup for critical business data at scale.
This enhancement supports enterprise-ready data protection and automation, enabling organizations to safeguard content more efficiently while maintaining control through existing policy configurations.
This message is associated with Microsoft 365 Roadmap ID 464990.
Roadmap 9 / 16 Summary
New
Sales Development Agent now integrates with Salesforce, enabling organizations to use SDA with their existing Salesforce CRM. SDA can access leads, manage prospect records, log sales activities, and keep engagement actions—including qualification, disqualification, and ownership changes—connected to the CRM workflow. The integration uses Microsoft’s Salesforce Model Context Protocol (MCP) server to connect SDA with S…
Currently, to bring tasks from another project into a new project, you must manually enter the task details in the task grid or use schedule APIs. You can also use the Copy project feature to create a new project with the same tasks, but this feature has limitations: You copy the entire project, including unwanted tasks and extra information. You can't combine tasks from multiple projects into a new project. Wit…
With this feature, admins can scope their network data security data loss prevention policies, integrated with Entra GSA Internet Access, to apply to all websites (.) or all websites except specific cloud apps, allowing them to apply protection to cloud apps and websites that are not in the Defender Cloud App Catalog.
Enables auto‑labeling of existing SharePoint files to match the default sensitivity label configured on their document library. This helps organizations close labeling gaps for data at rest and ensure consistent, secure‑by‑default protection across SharePoint libraries—without relying on manual user labeling.
This feature posts a purchase order product receipt and the consumption of its linked project item requirement in one transaction. It applies when automatic item consumption is enabled or when you select Consume immediately while posting the product receipt. Both updates succeed together, or the system rolls them both back when an error occurs. The posting flow prevents duplicate project posting and preserves existin…
Review shared files without losing conversation context. When you open a PDF, Markdown, or HTML file from a Teams chat or channel message, the conversation appears alongside the file and takes you directly to where it was shared, allowing you to catch up on the discussion and respond without closing the file preview or switching back to chat.
Power Apps model-driven apps are now available as Business Apps in Work IQ. They can be accessed through the Work IQ (Preview) tool in Copilot Studio or through a natural-language chat experience powered by Work IQ MCP. In either experience, natural-language prompts let users list and read records or create, update, and delete them. For create and update, Work IQ maps supplied values to the appropriate app fields. Be…
Work IQ enables agents to create and edit Microsoft Office documents using organizational context, helping users produce and update content more efficiently.
Enable agents to upload files and content to supported Microsoft 365 destinations.
Updated
Users can now use the Teams Meet app to discover events across their organization, track what important events are upcoming, and plan and organize their own professional events. With this release, Meet app will be renamed to Events app.
Copilot in Forms is being enabled for Microsoft Forms in Government Cloud environments, bringing end-to-end AI assistance to forms, from creating a form, to refining and sending to analyzing results. This rollout includes key Copilot features such as: - Draft with Copilot - Distribution and monitoring - Copilot Insights - On-canvas Copilot features such as Rewrite question, Continue writing, Answer explanations, and …
Microsoft Edge is expanding tab and Workspace organization capabilities to suggest groupings, names, visuals, and labels. Users can manage these experiences through the proposed “Let Microsoft Edge help keep your tabs organized” setting under Privacy, search, and services > Search and connected experiences; administrators can control them using the TabServicesEnabled policy.
Engage is rolling out Custom Branding, a new admin-led capability that lets organizations define a customized, tenant-wide visual identity across the Engage web and mobile apps. Engage-level admins can configure a brand name, add large and small logos, and a theme color that is applied consistently for all users in the tenant. Branding is managed from the new Brand Center in the Viva Engage admin center and helps org…
We are introducing a reimagined SharePoint experience designed to be simple and intuitive, centered on the core jobs of discovering knowledge, publishing content, and building solutions. This update establishes the foundation for AI-assisted creation across the product. This includes an updated information architecture and cohesive design language, delivering a clean and consistent experience across surfaces. Updated…
With a Microsoft 365 Copilot license, transform offline discussions into structured, actionable, and searchable content with voice notes in Copilot.
AI citations analytics will help you track the usage of SP documents, news and pages through copilot and AI agents. You will be able to see how often a page or a file is referenced in a copilot response. You can also get insights into SharePoint site content getting referenced in copilot responses aggregated at the site level.
Copilot Chat can now better match search results from text that appears inside images embedded in Word and PowerPoint files is user's working files — such as scanned contracts in Word, text from tables, text from images — content that was previously difficult to search and find.
Targeted Audience Surveys let change leaders launch a Copilot Pulse survey directly from the Copilot Dashboard to all licensed or active users. Audiences update automatically using Insights data and respect existing dashboard filters like organization and job function, with privacy protected through population-level reporting only. Pair adoption metrics with employee sentiment in just a few clicks.
Alert auto-resolution & tagging rules let you tell DLP, in advance, how to handle predictable alerts. You define a rule once, and from then on DLP applies it automatically to every new alert: ● Resolve alerts you don't need to see - e.g., Low-severity alerts for mail sent only to your trusted partner domains, so they never reach your triage queue. ● Tag alerts so you can find and route them - e.g., label every al…
With the introduction of file archiving support in SharePoint Online, administrators are looking to seamlessly include archiving actions within their existing data retention policies. This means that, in addition to keeping or deleting data, admins want to now leverage Purview DLM to archive files according to organizational requirements, ensuring comprehensive governance across all stages of the content lifecycle in…
When files are opened in Windows, the operating system, and applications (for example, Microsoft Office and browsers) can create, rename, and delete temporary files as part of normal behavior. The Endpoint client audits these activities, resulting in high-volume, low-signal events that appear as “noise” for Insider Risk Management (IRM) customers. While global exclusions exist (file type, keyword, file path, etc.), s…
We are introducing file archiving support in SharePoint Online, utilizing this feature administrators can seamlessly include archiving actions within their existing data retention policies. This means that, in addition to keeping or deleting data, admins can now leverage Purview DLM to archive files according to organizational requirements, ensuring comprehensive governance across all stages of the content lifecycle …
With this update, Risky AI usage policy template will support priority content. Customers can define Sensitive Info Types (SITs), Trainable Classifiers, Sensitivity Labels as priority content, and get alerted only when the activity matches the selected priority content. Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, …
Stay connected to your team’s engagement with Viva Insights Workplace Metrics, available alongside your survey results in Viva Glint. Between survey cycles, leaders and managers can use these continuous, real-time metrics to see how their team is working and evaluate whether actions they are taking to improve engagement are having the desired impact. This feature currently supports work-life balance and collaboration…
Quickly find your files and leverage Copilot to get a better understanding within the search tab on the go. This item is no longer accurate and is being removed from the roadmap. We apologize for the inconvenience.
Newly announced retirements 3 View all
Tue 13 Oct 2026
214 new · 24 updatedM365 Status 3 / 0 Summary
New
User impact
Users may be unable to create or publish assignments in OneNote.
Current status
While our fix is continuing to deploy at a rate slower than originally anticipated, we're observing some reduction in the associated errors. However, our analysis of the infrastructure to which the fix has been deployed shows some portions aren't updating as expected, which is preventing the full remediation of the impact. We're analyzing these affected portions of infrastructure to determine whether there are any other actions necessary to totally resolve the issue.
Scope of impact
Impact is specific to some users attempting to create or publish assignments in Microsoft OneNote. Start time: Sunday, October 11, 2026, at 12:10 PM UTC
Root cause
A recent update to the authentication flow utilized in this event contained an issue, which is resulting in this issue.
Next steps
Friday, October 16, 2026, at 6:30 PM UTC
Updates
- While our fix is continuing to deploy at a rate slower than originally anticipated, we're observing some reduction in the associated errors. However, our analysis of the infrastructure to which the fix has been deployed shows some portions aren't updating as expected, which is preventing the full remediation of the impact. We're analyzing these affected portions of infrastructure to determine whether there are any other actions necessary to totally resolve the issue.
- We’ve begun deploying our fix to the affected environment and anticipate that this process will be complete by our next scheduled update.
- We’ve completed development of the fix and are preparing to deploy it across the affected environment. We’ll monitor service health as the deployment progresses to determine whether it is alleviating impact.
- We’re investigating elevated failures affecting assignment creation in Microsoft OneNote and are monitoring the affected environments to assess the extent of impact. We're developing and testing a fix as part of our mitigation efforts. Once validation is complete, we'll begin deploying the fix across the affected environment to restore service functionality.
Next update by: Friday, October 16, 2026, at 6:30 PM UTC
User impact
Users' Microsoft 365 Copilot document editing prompts may have failed in the Microsoft Word desktop app and web clients. Final status: After completing our analysis of the trend of increased traffic we observed through service health telemetry, we've determined that the service is healthy and a service incident didn't actually occur. This communication will expire in 24 hours. This is the final update for the event.
Current status
We've identified a trend of increased traffic through our analysis of service health telemetry that we believe may be contributing to this event. We're continuing our investigation to confirm our theory and develop our next steps.
Scope of impact
This issue may impact any user who is attempting to complete Copilot prompts in the Word desktop app or Office for the web. This information may be updated as our investigation continues.
Next steps
Tuesday, October 13, 2026, at 10:00 PM UTC
Updates
- Title: Users' Microsoft 365 Copilot document editing prompts may fail in the Microsoft Word desktop app and web clients User impact: Users' Microsoft 365 Copilot document editing prompts may have failed in the Microsoft Word desktop app and web clients. Final status: After completing our analysis of the trend of increased traffic we observed through service health telemetry, we've determined that the service is healthy and a service incident didn't actually occur. This communication will expire in 24 hours. This is the final update for the event.
- We've identified a trend of increased traffic through our analysis of service health telemetry that we believe may be contributing to this event. We're continuing our investigation to confirm our theory and develop our next steps.
- We're investigating service health telemetry to determine why these prompts are failing to complete.
- We're investigating a potential issue impacting Microsoft 365 Copilot Chat and checking for impact to your organization. We'll provide an update within 30 minutes.
Next update by: Tuesday, October 13, 2026, at 10:00 PM UTC
User impact
Users may have been unable to access multiple Microsoft 365 services using GSA.
Current status
We're finishing our restarts throughout the affected infrastructure and expect this will be complete and resolve all impact by Tuesday, October 13, 2026, at 7:00 PM UTC. Our telemetry is showing service recovery, and we'll continue to monitor to ensure full remediation.
Scope of impact
Some users in Germany that attempted to access Microsoft 365 services listed in the More info section using GSA may have been impacted. Start time: Tuesday, October 13, 2026, at 7:40 AM UTC End time: Tuesday, October 13, 2026, at 6:31 PM UTC
Root cause
A section of GSA infrastructure was performing below acceptable performance thresholds, affecting connectivity to Microsoft 365 services and resulting in impact. Next steps: - To help prevent similar impact in the future, we're further reviewing the GSA infrastructure and testing performance on the previously impacted portions of infrastructure. We'll provide a preliminary Post-Incident Report within two business days and a final Post-Incident Report within five business days.
Next steps
Tuesday, October 13, 2026, at 8:00 PM UTC
More info
Impacted services may have included, but not been limited to: - Outlook - Outlook on the web - OneDrive - SharePoint Online - Microsoft Teams - Windows 365 Cloud PCs Final status: We've completed our restarts throughout the affected infrastructure and confirmed through telemetry and user reports that this issue is resolved.
Updates
- Title: Users may be unable to access multiple Microsoft 365 services using Global Secure Access (GSA) User impact: Users may have been unable to access multiple Microsoft 365 services using GSA. More info: Impacted services may have included, but not been limited to: - Outlook - Outlook on the web - OneDrive - SharePoint Online - Microsoft Teams - Windows 365 Cloud PCs Final status: We've completed our restarts throughout the affected infrastructure and confirmed through telemetry and user reports that this issue is resolved. Scope of impact: Some users in Germany that attempted to access Microsoft 365 services listed in the More info section using GSA may have been impacted. Start time: Tuesday, October 13, 2026, at 7:40 AM UTC End time: Tuesday, October 13, 2026, at 6:31 PM UTC Root cause: A section of GSA infrastructure was performing below acceptable performance thresholds, affecting connectivity to Microsoft 365 services and resulting in impact. Next steps: - To help prevent similar impact in the future, we're further reviewing the GSA infrastructure and testing performance on the previously impacted portions of infrastructure. We'll provide a preliminary Post-Incident Report within two business days and a final Post-Incident Report within five business days.
- We're finishing our restarts throughout the affected infrastructure and expect this will be complete and resolve all impact by Tuesday, October 13, 2026, at 7:00 PM UTC. Our telemetry is showing service recovery, and we'll continue to monitor to ensure full remediation.
- As a workaround, users may disable GSA to access the affected Microsoft 365 services until the resolution of this incident. This quick update is designed to give the latest information on this issue.
- We're continuing our targeted restarts throughout the impacted infrastructure, and our telemetry shows services hosted on the restarted infrastructure are now operating at healthy service levels. We're also receiving confirmation that impact is resolved for some users.
- We're restarting a portion of impacted infrastructure where we've removed traffic and are seeing positive trends towards recovery. We've confirmed through internal testing that this resolves impact for some users and we're monitoring to validate the full recovery of the service.
- We've completed redirecting traffic to healthy infrastructure and are assessing for positive trends towards recovery. We're continuing to investigate additional mitigating actions to expedite remediation.
- We're redirecting traffic from the underperforming infrastructure to improve service health. We're monitoring to confirm this will fully resolve impact. This quick update is designed to give the latest information on this issue.
- We've deployed the traffic optimizations and although we saw a reduction of errors initially, this did not fully resolve the issue. We're continuing to troubleshoot the issue to develop additional mitigation strategies.
Next update by: Tuesday, October 13, 2026, at 8:00 PM UTC
Updated
—
Message Center 7 / 10 Summary
New
What and why
Microsoft Teams will soon support sharing video directly from OneDrive during Teams events. Organizers and producers using Manage what attendees see can load videos from OneDrive and present them on stage without screen sharing a local media player or embedding videos in PowerPoint. This improvement provides smoother, higher-quality video playback for attendees and simplifies event production through built-in video playback controls.
What and why
We are introducing AI-generated status reports in Planner Agent. This feature uses Planner plan data to generate a status report that summarizes overall status, progress, risks, and next steps. Users can customize reports by specifying items such as audience, tone, length, reporting period, and report sections before reviewing and refining the generated content.
What and why
Microsoft Entra is changing who can create agent blueprints by default. Starting November 4, default users will be able to create new agent blueprints unless an administrator turns off Users can create agent blueprints. This means that users without built-in or custom Entra roles will be able to create new agent blueprints in their organization. From now until rollout begins, you can set your tenant preferences to prepare for this rollout. If you do not want users in your organization to create new agent blueprints and their identities, follow the instructions below.
What and why
We’re making updates across Microsoft Outlook experiences to improve clarity and consistency across endpoints. The first updates focus on visual details such as icons, spacing, and alignment, while maintaining familiar ways of working.
These updates are part of an ongoing series of improvements across Outlook experiences and are not a replacement for the classic Outlook experience.
What and why
Microsoft Entra Agent ID is enforcing tighter restrictions for autonomous creation of an agent’s own identities. Currently, all agents are granted AgentIdentity.CreateAsManager upon creation without administrator approval. Starting November 4, Microsoft Entra will no longer automatically grant AgentIdentity.CreateAsManager to agent blueprint principals, and creation of identities will need an admin to grant consent.
Agents that use app-only authentication to create their own agent identities must be explicitly granted the AgentIdentity.CreateAsManager Microsoft Graph application permission or move to another supported authorization model before enforcement reaches their tenant.
What and why
We’re removing the Agent 365 license requirement for observability data for supported agents built by Microsoft or on Microsoft platforms. This change expands access to usage and activity insights in the Microsoft 365 admin center, helping administrators monitor how agents are used.
This change is limited to observability metrics. It does not remove licensing requirements for other Agent 365 capabilities or for agent activity metrics for agents built on third-party platforms.
How does this affect me?
With this feature enabled, active Entra ID users who do not have a valid Dynamics 365 or Power Apps license can be selected in fields such as:
- Email: To, Cc, and Bcc
- Appointment: Owner, Required Attendees, and Optional Attendees
- Phone call: Owner, Call From, and Call To
- Task: Owner (co-owner)
This message is for awareness, and no action is required.
If you would like more information on this feature, please visit Add users without licenses to activity recipient fields (preview).
Updated
Updated October 13, 2026: We have updated the timeline. Thank you for your patience.
What and why
Microsoft Entra will soon recognize Windows Hello for Business (WHfB) and macOS Platform Single Sign-On (PSSO) as standalone multifactor authentication (MFA) factors in supported authentication scenarios.
Today, WHfB and macOS PSSO can satisfy MFA requirements during primary sign-in, but users may still be required to register and use an additional passkey or authentication method for certain step-up authentication prompts, Authentication Strength policies, and sign-in frequency checks.
After this rollout, users who authenticate with WHfB or macOS PSSO will be able to satisfy supported MFA requirements without registering an additional passkey. This change helps organizations expand the use of phishing-resistant authentication methods and reduce reliance on less secure authentication methods. As part of this change, a user's WHfB and macOS PSSO credentials will be displayed in My Security Info as auto-registered passkeys.
Updated October 13, 2026: We have updated the timeline. Thank you for your patience.
What and why
Microsoft Purview Information Protection is introducing File Labeler and File Viewer applications for macOS. These clients will bring sensitivity labeling and protected file viewing capabilities to Mac users, aligning with the experience already available on Windows.
This update will help organizations consistently apply and enforce protection policies across platforms, supporting enterprise-grade security and compliance for sensitive content across devices.
This message is associated with Microsoft 365 Roadmap ID 561327.
Updated October 13, 2026: We have updated the timeline. Thank you for your patience.
What and why
Microsoft Edge is introducing an upgraded Copilot new tab page that brings Microsoft 365 Copilot chat, web search, and work content into a single experience. Users can search the web, navigate to websites, interact with Microsoft 365 Copilot, and access relevant work content from a single experience.
The updated experience includes enhanced Copilot chat integration, compose capabilities, suggested actions, curated work content, and a refreshed design to help users complete tasks more efficiently.
This message is associated with Microsoft 365 Roadmap ID 566703.
Updated October 13, 2026: We have decided not to move forward with this change at this time. We will communicate via Message center when we are ready to proceed. We apologize for any inconvenience.
What and why
We are introducing Policy Sync and Device Health AI skills for Microsoft Purview Endpoint Data Loss Prevention. These AI-powered capabilities provide real-time visibility into policy deployment across devices and help admins quickly identify and resolve sync issues. By using AI to surface root causes and recommend actions, this feature improves troubleshooting efficiency and increases confidence that policies are enforced consistently across devices. This aligns with our enterprise-ready AI approach by delivering intelligent insights within Microsoft Purview.
Updated October 13, 2026: Following our earlier announcement, Apps in Copilot Studio has started its public preview rollout. Availability will expand gradually by region. Makers building apps in Copilot Studio will use the Copilot Credits available in the environment they're building in. Copilot Credits for app building are allocated, monitored, and billed through the same Power Platform admin center experience you already use for agents in Copilot Studio — no separate setup is required. Admins can review the credit allocation documentation in PPAC to learn more: https://learn.microsoft.com/en-us/power-platform/admin/manage-copilot-studio-copilot-credits-capacity
What and why
We are announcing a preview of the new app-building experience in Microsoft Copilot Cowork. A corresponding experience in Microsoft Copilot Studio will follow within the next couple of weeks. These experiences make it easier for people to turn ideas into apps using natural-language guidance and generative AI.
Updated October 13, 2026: We have updated the timeline. Thank you for your patience.
Enable admins to apply retention policy or retention label in OneDrive and SharePoint for files that have not been accessed by anyone in the organization after a period of time. In this release, users will be able to set up delete policies based on Last Accessed Date of Office file types. Non-office file types are not supported in this release.
This message is associated with Microsoft 365 Roadmap ID 472030.
Updated October 13, 2026: We have updated the timeline. Thank you for your patience.
What and why
We are updating the entry point for Copilot in Outlook to be more visually appealing and consistent. Located next to the Outlook ribbon, the Copilot entry point makes it easier for users to discover and use Copilot as they work. In addition to chat, it also surfaces contextual, AI-powered recommendations based on the task at hand, such as reading email, composing messages, or managing a calendar. With a single click, users can act on these suggestions to quickly summarize content, draft responses, organize information, and accomplish tasks more efficiently. The experience is designed to bring relevant Copilot capabilities closer to the user's workflow while providing a consistent Copilot experience across Microsoft 365 applications.
Updated October 13, 2026: We have updated the content. Thank you for your patience.
What and why
To improve transparency and troubleshooting for Microsoft Purview role-based access control (RBAC), we are enhancing audit logging for permission checks performed in the Microsoft Purview portal. These new audit records will provide administrators with clearer visibility into role and scoped-role authorization decisions, helping them investigate access issues and better understand how access evaluations are performed.
This message is associated with Microsoft 365 Roadmap ID 569363.
Updated September 18, 2026: We have updated the content. Thank you for your patience.
What and why
We are introducing a more consistent way for users to access and manage important resources in Microsoft Teams chats and channels. Users will be able to pin frequently used resources directly below the chat or channel header, pin multiple messages alongside other resources, and organize them into folders. On Microsoft Teams mobile, users will be able to access shared resources and folders by tapping the chat or channel header. This change will help users stay organized and provide them with a centralized location to quickly find, access, and manage important resources.
As part of this update, the In this chat and In this channel panes will be removed. Existing resources within these panes will be accessible through the new resource management experience.
Updated October 9, 2026: We have updated the content. Thank you for your patience.
What and why
We're introducing a new Microsoft Entra capability that allows password change after secure sign-in directly from My Sign-Ins using an existing strong credential, such as a passkey, FIDO2 security key, or Windows Hello for Business. Users can complete this action even if they don't know their current password and without using self-service password reset (SSPR) or contacting the helpdesk.
Many organizations are adopting allowed password changes after secure sign-ins but still maintain passwords for legacy applications and services. This update helps reduce password-related support requests and removes a common barrier to adoption. The feature is disabled by default and requires administrator enablement before users can access it.
Roadmap 17 / 13 Summary
New
Business performance planning improves the performance and flexibility of writeback from the Matrix visual. Writeback processing has been optimized to improve performance for planning adjustments, particularly for larger splash and multi-update operations. The improvements also optimize writeback for users with dimension security, where additional security validation is required. In addition, report designers no long…
Administrators can now assign Microsoft Dataverse group teams backed by Microsoft Entra groups to Business performance planning dimension security groups. Previously, dimension security assignments were limited to individual users. The updated experience allows administrators to view and add eligible Entra group-backed teams alongside users, with separate membership information for each assignment type. To use this c…
Create and manage contextual discussion threads directly on planning cubes and dimensions. Users can comment on dimension cells, detailed or aggregate cube cells, and reporting rows; reply to and mention colleagues; receive email notifications; and resolve or reactivate discussions. Public and private visibility options, together with an All Comments view, filters, export, and role-based management actions, support c…
This is a new web part available for modern page editors in SharePoint. The web part can be configured to use any M365 Copilot agent.
Microsoft Purview Data Loss Prevention is extending Administrative Units support to Microsoft 365 Copilot, Copilot Chat, and Cowork. This enables organizations to delegate management of supported Copilot DLP policies to administrators within their assigned Administrative Units, supporting regional, departmental, and regulatory boundaries without granting tenant-wide policy-management permissions. Existing tenant-wide…
Microsoft Purview server-side auto-labeling will support legacy Microsoft Office file formats, including Word (.doc), Excel (.xls), and PowerPoint (.ppt). Organizations can automatically evaluate and apply sensitivity labels to these files in SharePoint and OneDrive.
The Microsoft Visio Desktop MCP Server enables compatible AI clients to connect with the Visio Desktop application to create, read, and update Visio diagrams using natural language. It runs locally on Windows and requires a licensed Visio Desktop application.
This feature provides reusable MCP tools for Store Commerce POS returns. These tools expose Commerce return capabilities as structured actions that customers, partners, and agent developers can use to build conversational or agentic return experiences. The tools enable agentic experiences to look up the original purchase using supported identifiers such as receipt, order, invoice, or confirmation number; retrieve mat…
Consolidated AI settings make it easier for makers and admins to find and manage AI capabilities for model-driven apps across two complementary surfaces. In Maker Studio, the Settings dialog in the model app form designer adds a new top-level Copilot and AI tab. Makers can see and adjust all available AI options for the app in one place instead of finding them scattered among all the other settings. In the Power Plat…
Business end-users and buyers can define and maintain their own outbound follow-up scenarios and use them wherever built-in scenarios are used today: Scenario maintenance — a dedicated setup page where users create, edit, and maintain custom follow-up scenarios. Each scenario carries its own name, the instructions that shape the email the agent writes, and the business entity it applies to. Scenario-driven configura…
Shared mailbox users and delegates with read and manage (full access) and/or mail folder-level permission will now be able to access Copilot Chat directly from their shared and delegate mailboxes in classic Outlook, when added as a resource.
Quickly get started with modern single-page application (SPA) development by creating a site directly from Power Pages Studio. Continue building and customizing your experience using your preferred development tools and frameworks.
Provide a unified intelligence layer that helps agents discover, reason over, and use organizational knowledge.
Enable agents to use supported REST endpoints as tools through governed Work IQ integrations.
Enable A2A and MCP tasks to request missing information or authorization and then resume.
Enable durable long-running A2A and MCP tasks with progress tracking, later result retrieval, and cancellation.
Enable agents to retrieve relevant Microsoft 365 content and context through Work IQ.
Updated
Intelligent recap can now be generated without retaining a transcript after the meeting. Meeting organizers can choose this setting from the meeting options before the meeting, or organizers and eligible participants can enable it during the meeting. After the meeting, the AI Summary will be available, but other elements of the recap may not be available (Chapters, Topics, Mentions, Audio recap).
This feature is a collection of improvements including updates to the auto-save experience for comments, simplifying survey navigation through buttons by consolidating the "Skip" and "Done" buttons into a single "Next" button, and to give the survey taker greater control over question progression by refining the auto-scroll behavior when updating answers to questions.
You will now be able to add multiple steps to your workflow when building one from scratch.
Administrators can choose a severity threshold and receive alerts when a new Edge update includes security fixes that meet or exceed that level, including zero day fixes. This helps organizations quickly identify updates that may require attention, while avoiding unnecessary notifications for routine releases.
The HubSpot connector allows users using the Researcher agent to be able to leverage 3rd party information from HubSpot to enrich generated responses with relevant information.
We are introducing a more streamlined messaging experience that displays more content on screen while improving readability when using Teams on mobile. These updates make it easier to scan conversations and follow the discussion flow, helping users stay productive and engaged wherever they work.
Search, chat, and explore the web from one search box with Copilot-suggested actions and curated work content to help your users get things done faster on the Copilot new tab page. Users will see upgraded Copilot new tab page functionality and features.
The Microsoft Rights Management (RMS) connector is moving from shared-secret authentication to certificate-based authentication, improving its security posture. With this update, administrators configure their own Microsoft Entra app registration and certificate, then use the new PowerShell module to configure the certificate for each workload (Connector, Exchange, SharePoint, and FCI). New PowerShell cmdlets handle …
Users can now upload videos directly into a Teams event or meeting from OneDrive from the "Manage view" options when an organizer has turned on Manage What Attendees See mode. This ensures a smoother high quality video playback with a more consistent experience for attendees.
AI agent skill to detect and alert unhealthy policy sync and device configuration.
This feature is bringing the Information Protection Filer Labeler and Viewer applications to the MacOS platform. Enabling customers to have the same capabilities available on Mac. Core functionality will be available with the exception of the Advanced label-based protection feature.
Teams will store AI-generated meeting memory files for meetings where Intelligent Recap was turned on, allowing Copilot (and Facilitator) to retain key insights from meetings beyond transcript retention periods and when a transcript was not saved. This enables Copilot to continue answering questions about past meetings even after the transcript expires or the meeting is over. Admins can also configure how long this A…
This creates the ability to apply Retention to each SharePoint or OneDrive item based on when it was last accessed by a user. #copilotcontrolsystem
Security advisories 187 / 1 All advisories
New
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Office Online Server: KB5002928
Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Office Online Server: KB5002928
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Office Online Server: KB5002928
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Office Online Server: KB5002928
16.0.10417.20228
Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 9.8 out of 10: critical. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 9.8 out of 10: critical. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.5 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 8.1 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 9.8 out of 10: critical. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 9.8 out of 10: critical. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 8.1 out of 10: high. Microsoft rates it Critical.
- No attacks reported yet, but Microsoft expects exploitation to be likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Exchange Server Subscription Edition RTM: KB5128895
15.02.2562.056 - Microsoft Exchange Server 2019 Cumulative Update 15: KB5128896
15.02.1748.055 - Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897
15.02.1544.050 - Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898
15.01.2507.077
- Microsoft Exchange Server Subscription Edition RTM: KB5128895
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 9.8 out of 10: critical. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 9.8 out of 10: critical. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 8.1 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 9.8 out of 10: critical. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 8.1 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Critical.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Microsoft heeft kwetsbaarheden verholpen in de Configuration Manager en Defender. Een lokale kwaadwillende kan de kwetsbaarheden misbruiken om zich verhoogde rechten toe te kennen en mogelijk toegang te krijgen tot gevoelige gegevens.
Microsoft Configuration Manager: |------------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |------------------|------|-------------------------------------| | CVE-2026-88075 | 8.80 | Verkrijgen van verhoogde rechten | |------------------|------|-------------------------------------|
What does this mean?
- NCSC rates the likelihood of abuse as medium and the possible impact as high.
- 3 vulnerabilities. See "Show CVE information" for each CVE.
- Affects: Microsoft Configuration Manager 2503, Microsoft Configuration Manager 2509, Microsoft Configuration Manager 2603, Microsoft Configuration Manager 2603 on .NET Core 2.1, Microsoft Defender for Endpoint for Linux, Windows Defender.
- What should you do? Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Microsoft heeft kwetsbaarheden verholpen in diverse Dynamics componenten. Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de categorieën schade zoals benoemd in onderstaande tabellen:
Microsoft Dataverse: |------------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |------------------|------|-------------------------------------| | CVE-2026-88131 | 9.80 | Uitvoeren van willekeurige code | |------------------|------|-------------------------------------|
What does this mean?
- NCSC rates the likelihood of abuse as medium and the possible impact as high.
- 6 vulnerabilities, highest CVSS 9.8. See "Show CVE information" for each CVE.
- Affects: Microsoft Dataverse, Microsoft Dynamics 365 (on-premises) version 9.1, Microsoft Dynamics NAV 2017 on Windows Server 2012, Microsoft Dynamics NAV 2018 on Windows Server 2012.
- What should you do? Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Microsoft heeft xxx kwetsbaarheden verholpen in diverse Office producten, zoals Word, Excel, Access, Outlook, Visio, Sharepoint en PowerPoint, maar ook subcomponenten als Shell, Azure Key Vault en Click-to-Run. Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zich verhoogde rechten toe te kennen, willekeurige code uit te voeren en toegang te krijgen tot gevoelige informatie in de context van het slachtoffer.
Voor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden een malafide bestand te openen of link te volgen.
What does this mean?
- NCSC rates the likelihood of abuse as medium and the possible impact as high.
- 40 vulnerabilities. See "Show CVE information" for each CVE.
- Affects: Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 for 32-bit editions, Microsoft Office LTSC 2021 for 64-bit editions, Microsoft Office LTSC 2024 for 32-bit editions ….
- What should you do? Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Microsoft heeft kwetsbaarheden verholpen in Exchange. Een kwaadwillende kan de kwetsbaarheden misbruiken om zich voor te doen als andere gebruiker, zich verhoogde rechten toe te kennen en willekeurige code uit te voeren met rechten van het proces.
Van de kwetsbaarheid met kenmerk CVE-2026-96940 is eerder al een out-of-band update verschenen, maar is ook opgenomen in deze cumulatieve update.
What does this mean?
- NCSC rates the likelihood of abuse as medium and the possible impact as high.
- 7 vulnerabilities, highest CVSS 8.8. See "Show CVE information" for each CVE.
- Affects: Exchange, Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 15, Microsoft Exchange Server Subscription Edition RTM.
- What should you do? Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
- Spoofing. An attacker can pretend to be another user or source, for example through a misleading link or page.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.1 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server 2019
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.
What does this mean?
- Tampering. An attacker can change data or settings without permission.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 6.8 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 7.0 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBClick to Run
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBClick to Run
https://aka.ms/OfficeSecurityReleases
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBClick to Run
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office 365 for Mac: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Office Online Server: KB5002928
16.0.10417.20228
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Office Online Server: KB5002928
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 5.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
Use after free in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 5.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Buffer underwrite ('buffer underflow') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Office Online Server: KB5002928
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 5.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
What does this mean?
- Security Feature Bypass. An attacker can get around a security feature.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
- Spoofing. An attacker can pretend to be another user or source, for example through a misleading link or page.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
- CVSS 4.6 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
- Spoofing. An attacker can pretend to be another user or source, for example through a misleading link or page.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
- CVSS 4.6 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 7.5 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
- Spoofing. An attacker can pretend to be another user or source, for example through a misleading link or page.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
- CVSS 7.3 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 7.5 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898
15.01.2507.077 - Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897
15.02.1544.050 - Microsoft Exchange Server Subscription Edition RTM: KB5128895
15.02.2562.056 - Microsoft Exchange Server 2019 Cumulative Update 15: KB5128896
15.02.1748.055
- Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898
Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897
15.02.1544.050 - Microsoft Exchange Server Subscription Edition RTM: KB5128895
15.02.2562.056 - Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898
15.01.2507.077 - Microsoft Exchange Server 2019 Cumulative Update 15: KB5128896
15.02.1748.055
- Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897
15.02.1544.050 - Microsoft Exchange Server Subscription Edition RTM: KB5128895
15.02.2562.056 - Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898
15.01.2507.077
- Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited with access to the device itself, without an account and without any user action.
- CVSS 6.2 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Windows 11 Version 24H2 for x64-based Systems: KB5127648
10.0.26100.9711 - Windows 11 Version 25H2 for x64-based Systems: KB5127648
10.0.26200.9711 - Windows 11 Version 26H1 for ARM64-based Systems: KB5127646
10.0.28000.3231 - Windows 11 version 26H1 for x64-based Systems: KB5127646
10.0.28000.3231 - Windows 11 Version 24H2 for ARM64-based Systems: KB5127648
10.0.26100.9711 - Windows Server 2025: KB5126646
10.0.26100.33650
- Windows 11 Version 24H2 for x64-based Systems: KB5127648
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Skype for Business Server Subscription Edition RTM: KBRelease Notes
7.0.2046.889 - Skype for Business Server 2015 CU13: KB5132779
6.0.9319.886 - Skype for Business Server 2019 CU8: KB5131693
7.0.2046.583 - Skype for Business Server Subscription Edition CU1: KB5131692
7.0.2046.889
- Skype for Business Server Subscription Edition RTM: KBRelease Notes
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.1 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Skype for Business Server 2015 CU13: KB5132779
6.0.9319.886 - Skype for Business Server 2019 CU8: KB5131693
7.0.2046.583 - Skype for Business Server Subscription Edition CU1: KB5131692
7.0.2046.889
- Skype for Business Server 2015 CU13: KB5132779
Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898
15.01.2507.077 - Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897
15.02.1544.050 - Microsoft Exchange Server 2019 Cumulative Update 15: KB5128896
15.02.1748.055 - Microsoft Exchange Server Subscription Edition RTM: KB5128895
15.02.2562.056
- Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Skype for Business Server 2019 CU8: KB5131693
7.0.2046.583 - Skype for Business Server 2015 CU13: KB5132779
6.0.9319.886 - Skype for Business Server Subscription Edition CU1: KB5131692
7.0.2046.889
- Skype for Business Server 2019 CU8: KB5131693
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 7.5 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
What does this mean?
- Spoofing. An attacker can pretend to be another user or source, for example through a misleading link or page.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 9.3 out of 10: critical. Microsoft rates it Important.
- No attacks reported yet, but Microsoft expects exploitation to be likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898
15.01.2507.077 - Microsoft Exchange Server 2019 Cumulative Update 15: KB5128896
15.02.1748.055 - Microsoft Exchange Server Subscription Edition RTM: KB5128895
15.02.2562.056 - Microsoft Exchange Server 2019 Cumulative Update 14: KB5128897
15.02.1544.050
- Microsoft Exchange Server 2016 Cumulative Update 23: KB5128898
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 7.0 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), only with admin rights and without any user action.
- CVSS 7.2 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 7.5 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), only with admin rights and without any user action.
- CVSS 4.9 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 5.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
- CVSS 8.0 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Power Apps
2608.5 - Microsoft Power Apps for Android: KBRelease Notes
3.26085.7
- Microsoft Power Apps
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 7.5 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190 - Microsoft SharePoint Server 2019
- Microsoft SharePoint Enterprise Server 2016
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.20934 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20878 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20878 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.20934 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 4.3 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper input validation in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.5 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.5 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over an adjacent network.
What does this mean?
- Spoofing. An attacker can pretend to be another user or source, for example through a misleading link or page.
- It can be exploited from the same local network, with an ordinary user account and without any user action.
- CVSS 5.7 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.5 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 7.5 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 7.4 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 6.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
- Spoofing. An attacker can pretend to be another user or source, for example through a misleading link or page.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
- CVSS 4.6 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and without any user action.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
What does this mean?
- Spoofing. An attacker can pretend to be another user or source, for example through a misleading link or page.
- It can be exploited over the network (including from the internet if the service is reachable there), with an ordinary user account and if a user takes part, for example by opening a link or file.
- CVSS 4.6 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft SharePoint Server Subscription Edition: KB5002927
16.0.20326.20190
- Microsoft SharePoint Server Subscription Edition: KB5002927
- This applies to SharePoint Server you run yourself. Microsoft updates SharePoint Online in Microsoft 365.
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office LTSC for Mac 2024: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases
- Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes
16.0.14334.20974 - Microsoft 365 Apps for Enterprise for 64-bit Systems: KBRelease Notes
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes
16.0.14334.20974
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBRelease Notes
Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
What does this mean?
- Elevation of Privilege. An attacker can gain more rights than they should have, for example admin rights.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 7.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Defender for Endpoint for Linux
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
What does this mean?
- Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
- CVSS 8.8 out of 10: high. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
16.0.17932.21056 - Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes
16.0.17932.21056 - Office Online Server: KB5002928
16.0.10417.20228 - Microsoft Office LTSC for Mac 2024: KBRelease Notes
- Microsoft Office LTSC for Mac 2021: KBRelease Notes
- Microsoft Office 365 for Mac: KBRelease Notes
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes
Updated
Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited over the network (including from the internet if the service is reachable there), without an account and without any user action.
- CVSS 8.6 out of 10: high. Microsoft rates it Critical.
- What should you do? Nothing: Microsoft fixed this in the cloud service. There is no update to install.
Wed 14 Oct 2026
4 new · 2 updatedM365 Status 3 / 2 Summary
New
User impact
Users may be missing the "Meeting options" button for Microsoft Teams meetings in multiple Microsoft 365 apps.
Current status
We've received reports from multiple organizations noting that some users are missing the "Meeting options" button for Microsoft Teams meetings in multiple Microsoft 365 apps as listed in the "More info" section of this communication. We've isolated that a tenant filter to disable the "Meetings option" button for a specific group of users was unintentionally applied broadly. We're rolling back the offending change, and we anticipate impact to be remediated by our next scheduled update.
Scope of impact
This issue impacts some users who may be missing the "Meeting options” button when creating standard meetings using multiple Microsoft 365 apps. This section may be updated as the investigation progresses. Start time: Monday, October 12, 2026, at 8:48 PM UTC Estimated time to resolve: We anticipate impact to be resolved by our next scheduled update on Wednesday, October 14, 2026, at 9:00 PM UTC.
Root cause
A tenant filter to disable the "Meeting options" button for a specific organization was unintentionally applied broadly to multiple organizations.
Next steps
Wednesday, October 14, 2026, at 9:00 PM UTC
More info
This issue is occurring in the following Microsoft 365 apps: - Microsoft Teams desktop client - Microsoft Teams web client - Outlook on the web - Outlook desktop client The issue only occurs in standard Teams meetings, and live events, webinars, and town halls aren’t affected.
Updates
- We've received reports from multiple organizations noting that some users are missing the "Meeting options" button for Microsoft Teams meetings in multiple Microsoft 365 apps as listed in the "More info" section of this communication. We've isolated that a tenant filter to disable the "Meetings option" button for a specific group of users was unintentionally applied broadly. We're rolling back the offending change, and we anticipate impact to be remediated by our next scheduled update.
Next update by: Wednesday, October 14, 2026, at 9:00 PM UTC
User impact
Admins may encounter delays in accessing audit log data results in Microsoft Purview.
Current status
Our monitoring identified an increase in processing latency with Microsoft Purview audit log data. We've analyzed service telemetry and determined that a dependent service isn't processing requests as efficiently as expected, resulting in impact. We've taken action to rebalance load and improve throughput. While most users should see relief, we're continuing to monitor as the remaining backlog of events are processed, and we'll provide a complete remediation timeline once available.
Scope of impact
Any admin accessing audit log data from Microsoft Purview may be affected.
Next steps
Wednesday, October 21, 2026, at 6:00 PM UTC
More info
Affected users are encountering delays when accessing audit log data from the Microsoft Purview portal, Microsoft Graph API, or PowerShell.
Updates
- Our monitoring identified an increase in processing latency with Microsoft Purview audit log data. We've analyzed service telemetry and determined that a dependent service isn't processing requests as efficiently as expected, resulting in impact. We've taken action to rebalance load and improve throughput. While most users should see relief, we're continuing to monitor as the remaining backlog of events are processed, and we'll provide a complete remediation timeline once available.
Next update by: Wednesday, October 21, 2026, at 6:00 PM UTC
User impact
Users were unable to see model selection options in Microsoft 365 Copilot chat.
Current status
We've identified a component responsible for producing the model selection options in Copilot chat was not functioning correctly. To mitigate impact, we've developed a fix which is currently being deployed to the affected infrastructure and we're monitoring this process closely to ensure it delivers the expected resolution.
Scope of impact
Some users attempting to access GPT, Claude, or other model selection options in Copilot chat were impacted. Start time: Wednesday, October 14, 2026, at 3:34 AM UTC End time: Wednesday, October 14, 2026, at 9:30 AM UTC Preliminary root cause: A recent change resulted in the component responsible for producing the model selection options in Copilot chat to not function correctly. Next steps: - We're analyzing service telemetry on the affected component to help prevent this problem from happening again. We’ll provide a preliminary Post-Incident Report within two business days and a final Post-Incident Report within five business days.
Next steps
Wednesday, October 14, 2026, at 11:00 AM UTC
More info
Affected users were unable to see GPT, Claude, or other available models within the model selection options in Copilot chat. Final status: We’ve verified through service telemetry and previously impacted users that the issue is now resolved.
Updates
- Title: Some users were unable to see model selection options in Microsoft 365 Copilot chat User impact: Users were unable to see model selection options in Microsoft 365 Copilot chat. More info: Affected users were unable to see GPT, Claude, or other available models within the model selection options in Copilot chat. Final status: We’ve verified through service telemetry and previously impacted users that the issue is now resolved. Scope of impact: Some users attempting to access GPT, Claude, or other model selection options in Copilot chat were impacted. Start time: Wednesday, October 14, 2026, at 3:34 AM UTC End time: Wednesday, October 14, 2026, at 9:30 AM UTC Preliminary root cause: A recent change resulted in the component responsible for producing the model selection options in Copilot chat to not function correctly. Next steps: - We're analyzing service telemetry on the affected component to help prevent this problem from happening again. We’ll provide a preliminary Post-Incident Report within two business days and a final Post-Incident Report within five business days.
- We've completed deploying the fix to the affected infrastructure, and we've verified in our internal environment that the model selection options have been restored within Copilot chat. We're now contacting affected customers directly to ensure the fix has produced the expected resolution. This quick update is designed to give the latest information on this issue.
- We've identified a component responsible for producing the model selection options in Copilot chat was not functioning correctly. To mitigate impact, we've developed a fix which is currently being deployed to the affected infrastructure and we're monitoring this process closely to ensure it delivers the expected resolution.
- We’re reviewing service monitoring telemetry and support provided information to determine why model selection options aren’t appearing as expected, in order to develop a remediation plan.
- We've received reports indicating an issue with model selection options in Copilot Chat. We're reviewing service monitoring telemetry to isolate the root cause and determine our next troubleshooting steps.
Next update by: Wednesday, October 14, 2026, at 11:00 AM UTC
Updated
User impact
Users may be unable to reply or reply-all to email messages sent to Microsoft 365 groups in Exchange Online.
Current status
Our fix deployment has completed in the initial deployment rings and has started saturating in affected customers' environments. Our monitoring has validated that our fix has completed approximately 93 percent of the deployment, and we'll provide an updated timeline for it completing once it has become available.
Scope of impact
This issue impacts any user attempting to reply or reply-all to email messages sent to Microsoft 365 groups in Exchange Online. This information may be updated as our investigation continues. Start time: Tuesday, September 8, 2026, at 11:00 PM UTC
Root cause
A recent change made to the service removed an attribute component from the service process that requires that attribute, leading to impact.
Next steps
Thursday, October 15, 2026, at 8:30 PM UTC
More info
As a temporary alternative, impacted users may reply or reply all to email messages through user inboxes.
Updates
- Our fix deployment has completed in the initial deployment rings and has started saturating in affected customers' environments. Our monitoring has validated that our fix has completed approximately 93 percent of the deployment, and we'll provide an updated timeline for it completing once it has become available.
- Our monitoring of the deployment is ongoing as it propagates through earlier deployment rings prior to beginning saturation to affected customers’ environments. We'll provide a projected timeline for remediation based on the rate of progress as one becomes available.
- We're continuing to monitor and track the saturation percentage of the fix deployment to ensure it reaches 100 percent in all affected environments.
- We've validated that the previously identified recent change that removed an attribute component from the service process that requires that attribute, has led to impact. We're continuing to monitor our fix deployment; however, this process is taking longer than anticipated. The current fix saturation is at roughly 90 percent, and we'll provide a timeline of completion once it becomes available.
- We're continuing to monitor the deployment of our fix as it progresses, and we'll aim to provide a timeline of completion by our next scheduled communications.
- Our fix deployment is nearing completion, and most affected users should now be experiencing recovery. We’ll continue monitoring the deployment to ensure it completes and restores service for all affected users.
- Our fix deployment is nearing completion, and most affected users should now be experiencing recovery. We’ll continue monitoring the deployment to ensure it completes and restores service for all affected users.
- We've initialized our fix deployment to the affected environment and anticipate the impact should be fully remediated by our next scheduled update.
Next update by: Thursday, October 15, 2026, at 8:30 PM UTC
User impact
Admins may see stale data in the Copilot Health page in the Microsoft 365 admin center.
Current status
We're continuing our efforts to develop a fix to gather the missing data needed to restore our pipeline and remediate the impact. Once internal validations are complete, we'll provide a timeline for the deployment.
Scope of impact
Some admins attempting to see the latest Copilot Health data in the Microsoft 365 admin center may be impacted. This information may be updated as our investigation continues.
Root cause
An upstream process responsible for Copilot Health data was disabled, resulting in the impact.
Next steps
Friday, October 16, 2026, at 8:00 PM UTC
More info
Specifically, monthly data in the Update channels, Microsoft 365 updates (Past 6 months view), Connected experiences status, and OneDrive status cards on the Copilot Health page may not reflect data after July 2026. The Today view in the Microsoft 365 updates card isn't affected.
Updates
- We're continuing our efforts to develop a fix to gather the missing data needed to restore our pipeline and remediate the impact. Once internal validations are complete, we'll provide a timeline for the deployment.
- We're developing a fix that will gather the missing data necessary to restore our pipeline and to remediate the impact. We'll provide a timeline for the deployment of our solution once internal validations have been completed.
- We’ve confirmed that the pipeline responsible for processing Copilot Health data is running. We're working to gather the missing data so we can rerun the pipeline and resolve the issue.
- We've confirmed that impact associated with CP1482212 persists as the data was not processed as expected. We're validating that the data is present to be able to run the pipeline successfully and remediate impact completely.
Next update by: Friday, October 16, 2026, at 8:00 PM UTC
Message Center 1 / 0 Summary
New
We've released updates to the following update channels for Microsoft 365 Apps:
- Current Channel
- Monthly Enterprise Channel
- Semi-Annual Enterprise Channel
Updated
—
Thu 15 Oct 2026
0 new · 0 updatedNo items this day.
Fri 16 Oct 2026
0 new · 0 updatedNo items this day.
Sat 17 Oct 2026
0 new · 0 updatedNo items this day.
Sun 18 Oct 2026
0 new · 0 updatedNo items this day.
Get it every week
Free, no account needed. Pick where you want the weekly digest.
https://www.365fanatic.com/feed/week/
- In Teams, open the Workflows app (or Power Automate) and create a new flow.
- Pick the trigger RSS: When a feed item is published and paste the feed URL above.
- Add the action Microsoft Teams: Post message in a chat or channel, pick the team and channel, and put Feed title and Primary feed link in the message.
- Save. Every new day in the digest now appears in the channel.
- Right-click the RSS Feeds folder (or File → Account Settings → RSS Feeds) and choose Add a New RSS Feed.
- Paste the feed URL and click Add.
Service health, Message Center, roadmap and Security Update Guide data © Microsoft; security advisories from NCSC (CC0). 365Fanatic is not affiliated with Microsoft or NCSC; this page surfaces a West Europe reference tenant.
