Advisories
Microsoft Office Word CVE-2026-108439 RCE – Omitted from October 2026 Patch
Microsoft identified that the October 2026 security update for Office Word did not list CVE‑2026‑108439, a remote code execution flaw. The patch already contains the fix, so systems that applied the October 2026 updates are protected. Defenders should verify that the October 2026 update is installed and monitor for any unpatched environments.
What Happened
Microsoft Office Word suffered a remote code execution flaw (CVE‑2026‑108439). The October 2026 security update that fixed the issue was mistakenly omitted from the public advisory list.
Impact
All Office Word installations that have not applied the October 2026 update remain vulnerable. Systems that already installed the update are protected.
What to Do
Confirm that the October 2026 update is installed on all endpoints. If the update is missing, apply it immediately. No additional mitigations are required for systems that are up‑to‑date.
Related vulnerabilities
Microsoft Office Excel Remote Code Execution Vulnerability (CVE-2026-108446) Omitted from Oct 2026 Update
Microsoft Office Excel CVE-2026-108446, a remote code execution flaw, was fixed in the October 2026 security patch but omitted from the public update list. Systems with the October 2026 updates are already protected; no further action is required.
Read briefing
Microsoft Office Word CVE‑2026‑108437 RCE – Omitted from October 2026 Update
A remote code execution flaw in Microsoft Office Word (CVE‑2026‑108437) was fixed in the October 2026 security update, but the CVE was omitted from the public update list. Systems with Word that have not applied the October 2026 patch remain vulnerable. Administrators should verify patch status and install the update if missing.
Read briefing
Microsoft Office Word RCE CVE-2026-108443 Omitted from October 2026 Update
A remote code execution vulnerability (CVE-2026-108443) in Microsoft Office Word was fixed in the October 2026 security update, but the CVE was omitted from the advisory list. The flaw could be triggered by a crafted document, allowing arbitrary code execution on affected systems. Defenders should verify that the October 2026 update is installed; no further action is required if it is.
Read briefing
CVE-2026-108430: Microsoft Office Word Remote Code Execution – Update Omission Clarified
Microsoft Office Word users may have been unaware that the CVE-2026-108430 remote code execution flaw was fixed in the October 2026 security patch, which was mistakenly omitted from the update catalog. If your environment has already applied the October 2026 updates, no further action is required. Verify patch status and monitor for any related advisories.
Read briefing