Vulnerabilities
Microsoft adds missing CVE-2026-108451 for Office Word RCE to October 2026 patch notes
Microsoft clarified that CVE-2026-108451, a remote code execution flaw in Office Word, was fixed in October 2026 updates but was accidentally left out of the published security update list. The change is informational only. Organizations that already applied the October 2026 Office updates do not need additional action, but defenders should verify patch status and keep Word deployment controls in place.
Microsoft published an informational update for CVE-2026-108451, a remote code execution vulnerability in Microsoft Office Word. The flaw was remediated in October 2026 updates, but the CVE was not included in the October 2026 security update publication. The company described the change as informational only.
What happened
The October 2026 patch cycle contained the fix for the Word RCE issue, but the CVE identifier was omitted from the security update list. Microsoft is correcting the record, not releasing a new patch.
Who is affected
- Environments running Microsoft Office Word that had not installed the October 2026 updates.
- Organizations tracking CVE-2026-108451 in vulnerability management, EDR, or patch compliance tooling.
- Teams that rely on published CVE lists to validate that a specific Office Word RCE was addressed.
What defenders should do
- Confirm that Office Word systems received the October 2026 updates through patch management, endpoint inventory, or update logs.
- Reconcile CVE-2026-108451 in ticketing and risk systems so the missing publication does not create a false open finding.
- Maintain standard Office hardening: restrict macros, use protected view, limit Office installation to trusted accounts, and monitor for Office process anomalies.
No additional remediation is required for customers who already installed the October 2026 updates.
Related vulnerabilities
Microsoft Office Word CVE‑2026‑108437 RCE – Omitted from October 2026 Update
A remote code execution flaw in Microsoft Office Word (CVE‑2026‑108437) was fixed in the October 2026 security update, but the CVE was omitted from the public update list. Systems with Word that have not applied the October 2026 patch remain vulnerable. Administrators should verify patch status and install the update if missing.
Read briefing
Microsoft clarifies Office Word RCE CVE-2026-108450 was fixed in October 2026 updates
Microsoft published an informational update for CVE-2026-108450, a remote code execution vulnerability in Microsoft Office Word. The flaw was addressed by October 2026 updates, but the CVE was accidentally left out of the October 2026 security update listing. Organizations that have already deployed the October 2026 Office updates do not need additional action.
Read briefing
CVE-2026-108449: Microsoft Word RCE - Update Reminder
A remote code execution vulnerability in Microsoft Word (CVE-2026-108449) was initially addressed in October 2026 updates but was not formally documented in the security bulletin. Defenders should confirm October 2026 updates are applied to mitigate potential risk.
Read briefing
CVE-2026-108430: Microsoft Office Word Remote Code Execution – Update Omission Clarified
Microsoft Office Word users may have been unaware that the CVE-2026-108430 remote code execution flaw was fixed in the October 2026 security patch, which was mistakenly omitted from the update catalog. If your environment has already applied the October 2026 updates, no further action is required. Verify patch status and monitor for any related advisories.
Read briefing