Vulnerabilities
Microsoft Office Access Remote Code Execution Vulnerability (CVE-2026-102849)
A heap-based buffer overflow in Microsoft Office Access (CVE-2026-102849) permits remote code execution by an unauthenticated attacker. All versions of Office Access are vulnerable until Microsoft releases a patch. Defenders should apply the update immediately, restrict network access to Office files, and monitor for exploitation attempts.
What happened
A heap-based buffer overflow in Microsoft Office Access allows an unauthenticated attacker to execute arbitrary code remotely (CVE-2026-102849).
Impact
All versions of Office Access are potentially affected. Successful exploitation results in full code execution on the target system, enabling data theft, lateral movement, or persistence.
Mitigation
Apply the Microsoft security update for Office Access as soon as it becomes available. Until the patch is deployed, restrict network access to Office files, disable macros, and enforce least-privilege execution policies.
Monitoring
Watch for anomalous network traffic to Office Access processes, unexpected privilege escalation, and signs of code injection. Use endpoint detection and response (EDR) to flag suspicious activity.
Related vulnerabilities
Microsoft Excel CVE‑2026‑68794 Remote Code Execution Vulnerability
Microsoft has confirmed a remote code execution flaw in Excel (CVE‑2026‑68794) that could let attackers run arbitrary code via a crafted spreadsheet. Defenders should monitor for patches, restrict macro execution, and enforce least‑privilege handling of Office files.
Read briefing
CVE-2026-69724: Remote Code Execution Vulnerability in Microsoft Office SharePoint
Microsoft Office SharePoint is affected by CVE-2026-69724, a remote code execution vulnerability. Microsoft has acknowledged the issue, but no patch has been released yet. Defenders should monitor for updates, apply patches promptly, and enforce strict access controls.
Read briefing
Remote Code Execution Vulnerability in Microsoft Office (CVE-2026-100208)
A critical remote code execution flaw has been identified in Microsoft Office 365 Apps for Enterprise and Office LTSC 2021/2024. The vulnerability can be triggered by an attacker via a crafted document, enabling arbitrary code execution on affected systems. Immediate patching is required to mitigate the risk.
Read briefing
Microsoft Office for Mac RCE Vulnerability CVE-2026-81396 Fixed
Microsoft released a patch for CVE-2026-81396, a remote code execution flaw in Excel on Mac. Mac Office users must install the update immediately; other platforms are unaffected.
Read briefing