Advisories
Microsoft Office Word RCE CVE-2026-108443 Omitted from October 2026 Update
A remote code execution vulnerability (CVE-2026-108443) in Microsoft Office Word was fixed in the October 2026 security update, but the CVE was omitted from the advisory list. The flaw could be triggered by a crafted document, allowing arbitrary code execution on affected systems. Defenders should verify that the October 2026 update is installed; no further action is required if it is.
Microsoft Office Word was affected by a remote code execution flaw (CVE-2026-108443). The vulnerability was fixed in the October 2026 security update, but the CVE was mistakenly omitted from the update’s advisory list.
Impact
- Word 2016‑2026 (all supported versions) could be exploited via a crafted document.
- Successful exploitation allows arbitrary code execution on the victim’s machine.
Defender Actions
- Confirm that the October 2026 update (KBxxxxxx) is installed on all Word installations.
- If the update is missing, apply it immediately; no additional remediation is required.
- Maintain standard monitoring for anomalous process activity.
Additional Notes
Customers who have already applied the October 2026 security update do not need to take any further action.
Related vulnerabilities
Microsoft Office Excel Remote Code Execution Vulnerability (CVE-2026-108446) Omitted from Oct 2026 Update
Microsoft Office Excel CVE-2026-108446, a remote code execution flaw, was fixed in the October 2026 security patch but omitted from the public update list. Systems with the October 2026 updates are already protected; no further action is required.
Read briefing
Microsoft Office Word CVE‑2026‑108437 RCE – Omitted from October 2026 Update
A remote code execution flaw in Microsoft Office Word (CVE‑2026‑108437) was fixed in the October 2026 security update, but the CVE was omitted from the public update list. Systems with Word that have not applied the October 2026 patch remain vulnerable. Administrators should verify patch status and install the update if missing.
Read briefing
Microsoft: SharePoint RCE CVE-2026-108452 was fixed in October 2026 updates but omitted from the update list
Microsoft clarified that CVE-2026-108452, a remote code execution vulnerability in Microsoft Office SharePoint, was fixed in October 2026 updates but was accidentally omitted from the published Security Updates list. The change is informational only. Defenders should verify that SharePoint systems have the October 2026 updates installed and no additional patching is required for those already patched.
Read briefing
CVE-2026-108430: Microsoft Office Word Remote Code Execution – Update Omission Clarified
Microsoft Office Word users may have been unaware that the CVE-2026-108430 remote code execution flaw was fixed in the October 2026 security patch, which was mistakenly omitted from the update catalog. If your environment has already applied the October 2026 updates, no further action is required. Verify patch status and monitor for any related advisories.
Read briefing