Vulnerabilities
CVE-2026-108430: Microsoft Office Word Remote Code Execution – Update Omission Clarified
Microsoft Office Word users may have been unaware that the CVE-2026-108430 remote code execution flaw was fixed in the October 2026 security patch, which was mistakenly omitted from the update catalog. If your environment has already applied the October 2026 updates, no further action is required. Verify patch status and monitor for any related advisories.
What happened
Microsoft released a security update in October 2026 that fixed CVE-2026-108430, a remote code execution vulnerability in Microsoft Office Word. The CVE was inadvertently omitted from the public list of updates for that month, causing confusion among administrators.
Impact
Only installations of Microsoft Office Word that had not yet received the October 2026 patch are potentially vulnerable. The flaw allows an attacker to execute arbitrary code via a crafted Word document.
What to do
- Confirm that the October 2026 update package has been installed on all Word clients.
- Use Windows Update or WSUS to verify the presence of the KB that contains the fix.
- If the update is missing, deploy it immediately; otherwise no further action is needed.
- Maintain a record of the patch status for audit purposes.
Customers who have already installed the October 2026 updates do not need to take any further action.
Monitoring
Keep an eye on Microsoft’s Security Update Guide and the CVE database for any follow‑up notes or related advisories.
Related vulnerabilities
Microsoft Office Word CVE‑2026‑108437 RCE – Omitted from October 2026 Update
A remote code execution flaw in Microsoft Office Word (CVE‑2026‑108437) was fixed in the October 2026 security update, but the CVE was omitted from the public update list. Systems with Word that have not applied the October 2026 patch remain vulnerable. Administrators should verify patch status and install the update if missing.
Read briefing
CVE‑2026‑108455: PowerPoint Information Disclosure – Update Omission Clarified
Microsoft Office PowerPoint’s information disclosure vulnerability (CVE‑2026‑108455) was fixed in the October 2026 security update, but the CVE was omitted from the advisory list. Defenders should verify the update is installed; no further action is required if already updated.
Read briefing
Microsoft Office for Mac Remote Code Execution Vulnerability CVE-2026-78521 – Update Required
Microsoft has released patches for a remote code execution flaw (CVE-2026-78521) affecting Microsoft Office for Mac. The vulnerability can be triggered via malicious Word documents and allows arbitrary code execution. Office for Mac users must install the update immediately; other Office products are not impacted.
Read briefing
Microsoft adds missing CVE-2026-108451 for Office Word RCE to October 2026 patch notes
Microsoft clarified that CVE-2026-108451, a remote code execution flaw in Office Word, was fixed in October 2026 updates but was accidentally left out of the published security update list. The change is informational only. Organizations that already applied the October 2026 Office updates do not need additional action, but defenders should verify patch status and keep Word deployment controls in place.
Read briefing