CVE-2026-81386: Remote Code Execution in Microsoft Excel for Mac – Update Required

Microsoft Excel for macOS contains a remote code execution vulnerability (CVE‑2026‑81386) that can be triggered by opening a malicious workbook. The flaw allows an attacker to run arbitrary code with the privileges of the user who opens the file.

What happened

Microsoft identified a flaw in the Excel engine that parses certain XML structures. When a specially crafted file is opened, the parser can execute native code on the host system.

Impact

• Only Microsoft Office for Mac (Excel) is affected; Windows, iOS, and other Office products are not vulnerable.
• Successful exploitation results in full code execution on the target machine.
• Potential for data exfiltration, persistence, or lateral movement.

What to do

Office for Mac users must apply the latest security update immediately. The update is available through the standard macOS Software Update mechanism or via the Office installer. Verify the installed version is 16.76 or later.

Download the update and review the release notes at https://go.microsoft.com/fwlink/p/?linkid=831049.

Non‑Mac Office users do not need to take action. Monitor for any anomalous activity that could indicate exploitation attempts.