Advisories
Microsoft: SharePoint RCE CVE-2026-108452 was fixed in October 2026 updates but omitted from the update list
Microsoft clarified that CVE-2026-108452, a remote code execution vulnerability in Microsoft Office SharePoint, was fixed in October 2026 updates but was accidentally omitted from the published Security Updates list. The change is informational only. Defenders should verify that SharePoint systems have the October 2026 updates installed and no additional patching is required for those already patched.
What happened
Microsoft published an informational update for CVE-2026-108452, a remote code execution vulnerability in Microsoft Office SharePoint. The flaw was addressed in updates released in October 2026, but the CVE was accidentally left out of the October 2026 Security Updates listing.
Who is affected
Microsoft Office SharePoint environments that had not yet applied the October 2026 updates may have remained exposed until those updates were installed. Systems that already received the October 2026 updates are considered patched for this CVE.
What defenders should do
- Confirm that SharePoint servers have the October 2026 security updates installed.
- Treat the CVE omission as a documentation correction, not a new patch release.
- Record the CVE in vulnerability tracking systems and close it as remediated where October 2026 updates are present.
Microsoft states that customers who installed the October 2026 updates do not need to take further action.
Related vulnerabilities
Microsoft Office Excel Remote Code Execution Vulnerability (CVE-2026-108446) Omitted from Oct 2026 Update
Microsoft Office Excel CVE-2026-108446, a remote code execution flaw, was fixed in the October 2026 security patch but omitted from the public update list. Systems with the October 2026 updates are already protected; no further action is required.
Read briefing
Microsoft Office Word RCE CVE-2026-108443 Omitted from October 2026 Update
A remote code execution vulnerability (CVE-2026-108443) in Microsoft Office Word was fixed in the October 2026 security update, but the CVE was omitted from the advisory list. The flaw could be triggered by a crafted document, allowing arbitrary code execution on affected systems. Defenders should verify that the October 2026 update is installed; no further action is required if it is.
Read briefing
Microsoft Outlook CVE-2026-100208: Remote Code Execution Patch Included in August 2026 Updates
A remote code execution flaw (CVE-2026-100208) in Microsoft Office Outlook was fixed in the August 2026 security updates. The update was mistakenly omitted from the public CVE list, but the patch is already applied to all affected Outlook versions. If you have applied the August 2026 updates, no additional action is required; otherwise, install the update immediately.
Read briefing
Microsoft adds missing CVE-2026-108451 for Office Word RCE to October 2026 patch notes
Microsoft clarified that CVE-2026-108451, a remote code execution flaw in Office Word, was fixed in October 2026 updates but was accidentally left out of the published security update list. The change is informational only. Organizations that already applied the October 2026 Office updates do not need additional action, but defenders should verify patch status and keep Word deployment controls in place.
Read briefing