Vulnerabilities
CVE-2026-108449: Microsoft Word RCE - Update Reminder
A remote code execution vulnerability in Microsoft Word (CVE-2026-108449) was initially addressed in October 2026 updates but was not formally documented in the security bulletin. Defenders should confirm October 2026 updates are applied to mitigate potential risk.
What Happened
Microsoft has acknowledged that CVE-2026-108449, a remote code execution (RCE) vulnerability affecting Microsoft Word, was resolved with updates released in October 2026. However, the CVE identifier was inadvertently omitted from the official October 2026 Security Update Guide.
Impact
Successful exploitation of CVE-2026-108449 could allow a remote attacker to execute arbitrary code on a vulnerable system. This requires a user to open a specially crafted Microsoft Word document. The severity is currently unrated, but RCE vulnerabilities are generally considered high-priority.
What to Do
If you applied the October 2026 security updates, no further action is required. Microsoft confirms the vulnerability was patched in those releases. Verify update installation via Windows Update history or your patch management system.
Verification
Confirm the presence of the October 2026 security updates. Review patch deployment logs and utilize system inventory tools to verify update status across your environment.
Further Information
While this is an informational update, proactive verification is recommended. Monitor Microsoft's Security Update Guide for any future clarifications or revisions related to CVE-2026-108449.
Related vulnerabilities
Microsoft Office Word CVE‑2026‑108437 RCE – Omitted from October 2026 Update
A remote code execution flaw in Microsoft Office Word (CVE‑2026‑108437) was fixed in the October 2026 security update, but the CVE was omitted from the public update list. Systems with Word that have not applied the October 2026 patch remain vulnerable. Administrators should verify patch status and install the update if missing.
Read briefing
Microsoft clarifies Office Word RCE CVE-2026-108450 was fixed in October 2026 updates
Microsoft published an informational update for CVE-2026-108450, a remote code execution vulnerability in Microsoft Office Word. The flaw was addressed by October 2026 updates, but the CVE was accidentally left out of the October 2026 security update listing. Organizations that have already deployed the October 2026 Office updates do not need additional action.
Read briefing
Microsoft adds missing CVE-2026-108451 for Office Word RCE to October 2026 patch notes
Microsoft clarified that CVE-2026-108451, a remote code execution flaw in Office Word, was fixed in October 2026 updates but was accidentally left out of the published security update list. The change is informational only. Organizations that already applied the October 2026 Office updates do not need additional action, but defenders should verify patch status and keep Word deployment controls in place.
Read briefing
Microsoft Office Word RCE CVE-2026-108443 Omitted from October 2026 Update
A remote code execution vulnerability (CVE-2026-108443) in Microsoft Office Word was fixed in the October 2026 security update, but the CVE was omitted from the advisory list. The flaw could be triggered by a crafted document, allowing arbitrary code execution on affected systems. Defenders should verify that the October 2026 update is installed; no further action is required if it is.
Read briefing