Advisories
Microsoft Office Excel Remote Code Execution Vulnerability (CVE-2026-108446) Omitted from Oct 2026 Update
Microsoft Office Excel CVE-2026-108446, a remote code execution flaw, was fixed in the October 2026 security patch but omitted from the public update list. Systems with the October 2026 updates are already protected; no further action is required.
What Happened
Microsoft Office Excel suffered a remote code execution vulnerability (CVE‑2026‑108446). The flaw was fixed in the October 2026 security updates, but the CVE was inadvertently omitted from the public update catalog.
Impact
All versions of Microsoft Office Excel that received the October 2026 patch are affected. The vulnerability could allow an attacker to execute arbitrary code via a crafted Excel file.
What to Do
- Verify that the October 2026 security updates are installed on all Office Excel instances.
- Confirm that the system shows the October 2026 update in the Windows Update history.
- No additional remediation is required if the patch is present; otherwise, apply the October 2026 updates immediately.
Related vulnerabilities
Microsoft Office Word RCE CVE-2026-108443 Omitted from October 2026 Update
A remote code execution vulnerability (CVE-2026-108443) in Microsoft Office Word was fixed in the October 2026 security update, but the CVE was omitted from the advisory list. The flaw could be triggered by a crafted document, allowing arbitrary code execution on affected systems. Defenders should verify that the October 2026 update is installed; no further action is required if it is.
Read briefing
Microsoft Outlook CVE-2026-100208: Remote Code Execution Patch Included in August 2026 Updates
A remote code execution flaw (CVE-2026-100208) in Microsoft Office Outlook was fixed in the August 2026 security updates. The update was mistakenly omitted from the public CVE list, but the patch is already applied to all affected Outlook versions. If you have applied the August 2026 updates, no additional action is required; otherwise, install the update immediately.
Read briefing
Microsoft Excel for Mac RCE Vulnerability CVE-2026-81950 – Update Required
Microsoft released a security update for Office for Mac to fix a remote code execution flaw (CVE‑2026‑81950). The vulnerability affects all current Mac versions of Excel and can be triggered by malicious spreadsheets. Defenders should ensure Office for Mac is patched; other Office products are unaffected.
Read briefing
Microsoft Excel CVE‑2026‑68794 Remote Code Execution Vulnerability
Microsoft has confirmed a remote code execution flaw in Excel (CVE‑2026‑68794) that could let attackers run arbitrary code via a crafted spreadsheet. Defenders should monitor for patches, restrict macro execution, and enforce least‑privilege handling of Office files.
Read briefing