Vulnerabilities
Microsoft Office Word CVE‑2026‑108437 RCE – Omitted from October 2026 Update
A remote code execution flaw in Microsoft Office Word (CVE‑2026‑108437) was fixed in the October 2026 security update, but the CVE was omitted from the public update list. Systems with Word that have not applied the October 2026 patch remain vulnerable. Administrators should verify patch status and install the update if missing.
Microsoft Office Word was affected by a remote code execution flaw (CVE‑2026‑108437) that was fixed in the October 2026 security update. The update package was released, but the CVE was not listed in the official update catalog, potentially confusing administrators.
What happened
The CVE was discovered and addressed in the October 2026 update cycle. The update package containing the fix was released, but the CVE was not listed in the official update catalog, potentially confusing administrators.
Impact
Systems running unpatched Microsoft Office Word versions prior to the October 2026 update are vulnerable to remote code execution if an attacker can supply a malicious document. The vulnerability is exploitable via a crafted .docx file opened in Word.
What to do
- Verify that the October 2026 update (KBxxxxxx) is installed on all Windows machines with Office Word.
- Run Windows Update or use WSUS/Intune to confirm patch deployment.
- If the update is missing, manually install the Office cumulative update for October 2026.
- Consider disabling the “Open Office files from the internet” security setting as a temporary mitigator until the patch is applied.
Customers who have already installed the October 2026 updates do not need to take any further action.
Related vulnerabilities
Microsoft clarifies Office Word RCE CVE-2026-108450 was fixed in October 2026 updates
Microsoft published an informational update for CVE-2026-108450, a remote code execution vulnerability in Microsoft Office Word. The flaw was addressed by October 2026 updates, but the CVE was accidentally left out of the October 2026 security update listing. Organizations that have already deployed the October 2026 Office updates do not need additional action.
Read briefing
CVE-2026-108430: Microsoft Office Word Remote Code Execution – Update Omission Clarified
Microsoft Office Word users may have been unaware that the CVE-2026-108430 remote code execution flaw was fixed in the October 2026 security patch, which was mistakenly omitted from the update catalog. If your environment has already applied the October 2026 updates, no further action is required. Verify patch status and monitor for any related advisories.
Read briefing
Microsoft adds missing CVE-2026-108451 for Office Word RCE to October 2026 patch notes
Microsoft clarified that CVE-2026-108451, a remote code execution flaw in Office Word, was fixed in October 2026 updates but was accidentally left out of the published security update list. The change is informational only. Organizations that already applied the October 2026 Office updates do not need additional action, but defenders should verify patch status and keep Word deployment controls in place.
Read briefing
Microsoft Office Word RCE CVE-2026-108443 Omitted from October 2026 Update
A remote code execution vulnerability (CVE-2026-108443) in Microsoft Office Word was fixed in the October 2026 security update, but the CVE was omitted from the advisory list. The flaw could be triggered by a crafted document, allowing arbitrary code execution on affected systems. Defenders should verify that the October 2026 update is installed; no further action is required if it is.
Read briefing