Advisories
Microsoft Outlook CVE-2026-100208: Remote Code Execution Patch Included in August 2026 Updates
A remote code execution flaw (CVE-2026-100208) in Microsoft Office Outlook was fixed in the August 2026 security updates. The update was mistakenly omitted from the public CVE list, but the patch is already applied to all affected Outlook versions. If you have applied the August 2026 updates, no additional action is required; otherwise, install the update immediately.
What happened
A remote code execution vulnerability (CVE-2026-100208) was discovered in Microsoft Office Outlook. The flaw allows an attacker to execute arbitrary code on a victim’s machine via a crafted email or attachment.
Impact
Outlook users on versions prior to the August 2026 security update are vulnerable. The vulnerability was patched in the August 2026 update, but Microsoft omitted the CVE from the public update list.
What to do
Verify that the August 2026 security update has been installed on all Outlook clients:
- Open Outlook, go to File > Office Account > Update Options > Update Now.
- Check the installed update version; it should include the August 2026 security patch.
If the update is missing, install it immediately. No further action is required for systems already patched.
Microsoft has confirmed that the patch is fully functional and that no additional remediation steps are necessary for patched systems.
Related vulnerabilities
Remote Code Execution Vulnerability in Microsoft Office (CVE-2026-100208)
A critical remote code execution flaw has been identified in Microsoft Office 365 Apps for Enterprise and Office LTSC 2021/2024. The vulnerability can be triggered by an attacker via a crafted document, enabling arbitrary code execution on affected systems. Immediate patching is required to mitigate the risk.
Read briefing
CVE-2026-108448: Outlook RCE Vulnerability - Update Confirmation
A remote code execution (RCE) vulnerability in Microsoft Outlook (CVE-2026-108448) was initially addressed in October 2026 updates but was not formally documented in the security bulletin. Defenders should verify October 2026 updates are applied; no further action is needed if already patched.
Read briefing
Microsoft Office Word CVE-2026-108439 RCE – Omitted from October 2026 Patch
Microsoft identified that the October 2026 security update for Office Word did not list CVE‑2026‑108439, a remote code execution flaw. The patch already contains the fix, so systems that applied the October 2026 updates are protected. Defenders should verify that the October 2026 update is installed and monitor for any unpatched environments.
Read briefing
Microsoft Office Excel Remote Code Execution Vulnerability (CVE-2026-108446) Omitted from Oct 2026 Update
Microsoft Office Excel CVE-2026-108446, a remote code execution flaw, was fixed in the October 2026 security patch but omitted from the public update list. Systems with the October 2026 updates are already protected; no further action is required.
Read briefing