Vulnerabilities
Microsoft Excel CVE‑2026‑68794 Remote Code Execution Vulnerability
Microsoft has confirmed a remote code execution flaw in Excel (CVE‑2026‑68794) that could let attackers run arbitrary code via a crafted spreadsheet. Defenders should monitor for patches, restrict macro execution, and enforce least‑privilege handling of Office files.
What Happened
Microsoft has acknowledged the existence of a remote code execution vulnerability in Excel, identified as CVE‑2026‑68794. The flaw allows an attacker to execute arbitrary code by delivering a specially crafted Excel file to a vulnerable user.
Impact
Users of affected Excel versions who open or interact with malicious spreadsheets are at risk of code execution, potentially leading to system compromise, data exfiltration, or lateral movement within the network.
What to Do
- Verify that you are running the latest version of Microsoft Office and that all security updates have been applied.
- Disable or restrict macros and other active content in Excel until a patch is released.
- Implement file‑type restrictions and sandboxing for Office documents received via email or shared drives.
- Monitor for unusual process activity or network connections originating from Excel.
Microsoft has issued an informational acknowledgement and will provide a fix in an upcoming update. Stay tuned for official advisories.
Related vulnerabilities
Microsoft Office for Mac RCE Vulnerability CVE-2026-81396 Fixed
Microsoft released a patch for CVE-2026-81396, a remote code execution flaw in Excel on Mac. Mac Office users must install the update immediately; other platforms are unaffected.
Read briefing
CVE-2026-68798: Microsoft Excel Remote Code Execution Vulnerability Acknowledged
Microsoft has acknowledged a remote code execution flaw in Excel (CVE-2026-68798). No patch is currently available, but the vulnerability could allow attackers to execute arbitrary code via crafted spreadsheets. Defenders should monitor for updates, restrict macro execution, and enforce least privilege.
Read briefing
Microsoft Excel Remote Code Execution Vulnerability CVE-2026-55039 Acknowledged
Microsoft has acknowledged a remote code execution flaw in Excel (CVE‑2026‑55039). No patch is currently available, and defenders should monitor for updates and enforce best practices until a fix is released.
Read briefing
CVE-2026-97773: Office for Mac RCE – Update Required
Microsoft released a patch for CVE‑2026‑97773, a remote code execution flaw in Office for Mac. Mac users of Excel must install the update immediately; other Office products are unaffected.
Read briefing