Microsoft Office Visio Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+4 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Visio, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Text Shaping Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126835, KB5126836, KB5126868 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+30 more)Fix KB5126835, KB5126836, KB5126868 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5126835, KB5126836, KB5126868 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows Text Shaping, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Hyper-V Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126651, KB5126655, KB5126657 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+26 more)Fix KB5126651, KB5126655, KB5126657 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5126651, KB5126655, KB5126657 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows Hyper-V allows an authorized attacker to execute code locally.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows Hyper-V, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126868, KB5126651, KB5126657 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+26 more)Fix KB5126868, KB5126651, KB5126657 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5126868, KB5126651, KB5126657 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 7.0
Type
Security updates
Tags
Windows Virtualization-Based Security (VBS) Enclave, Elevation of Privilege, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Media Video Decoder Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126835, KB5126836, KB5126868 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+30 more)Fix KB5126835, KB5126836, KB5126868 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5126835, KB5126836, KB5126868 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows Media Video Decoder, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft QUIC Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126655, KB5126653, KB5127648 and 2 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems (+12 more)Fix KB5126655, KB5126653, KB5127648 and 2 more
What you should do
If you run the affected products, install Microsoft's update (KB5126655, KB5126653, KB5127648 and 2 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Microsoft QUIC, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Graphics Component Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5127648, KB5126646, KB5127646 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5127648, KB5126646, KB5127646 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5127648, KB5126646, KB5127646 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Microsoft Graphics Component, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+5 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002928 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+8 more)Fix KB5002928
What you should do
If you run the affected products, install Microsoft's update (KB5002928 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+5 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126835, KB5126836, KB5126868 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+30 more)Fix KB5126835, KB5126836, KB5126868 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5126835, KB5126836, KB5126868 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Windows Message Queuing Queue Manager, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Secure Kernel Mode Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5129194).
Severity CriticalExploited NoDisclosed NoAffects Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based SystemsFix KB5129194
What you should do
If you run the affected products, install Microsoft's update (KB5129194); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 8.2
Type
Security updates
Tags
Windows Secure Kernel Mode, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability. Microsoft rates it Important; it is reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Detected. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and 3 more).
Severity ImportantExploited YesDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+18 more)Fix KB5122876, KB5122882, KB5122878 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix and reports this vulnerability as exploited, so it matters if you run the affected products.
Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
Severity
Important · CVSS 7.8
Type
Security updates
Tags
Windows ALPC, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: Yes · Publicly disclosed: No · Exploitation Detected · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Important) is Microsoft's rating and is not treated as proof that action is needed.
Windows Secure Kernel Mode Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5124012).
Severity CriticalExploited NoDisclosed NoAffects Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based SystemsFix KB5124012
What you should do
If you run the affected products, install Microsoft's update (KB5124012); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 8.2
Type
Security updates
Tags
Windows Secure Kernel Mode, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation More Likely. Microsoft publishes a customer-installable fix (KB5122871, KB5124008, KB5122880 and 1 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems (+8 more)Fix KB5122871, KB5124008, KB5122880 and 1 more
What you should do
If you run the affected products, install Microsoft's update (KB5122871, KB5124008, KB5122880 and 1 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Out-of-bounds read in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to disclose information locally.
Severity
Critical · CVSS 5.5
Type
Security updates
Tags
Windows Virtualization-Based Security (VBS) Enclave, Information Disclosure, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation More Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122871, KB5124008, KB5122880 and 1 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems (+8 more)Fix KB5122871, KB5124008, KB5122880 and 1 more
What you should do
If you run the affected products, install Microsoft's update (KB5122871, KB5124008, KB5122880 and 1 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Windows Virtualization-Based Security (VBS) Enclave, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Update Stack Elevation of Privilege Vulnerability. Microsoft rates it Important; it is reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Detected. Microsoft publishes a customer-installable fix (KB5122871, KB5124008, KB5122880 and 1 more).
Severity ImportantExploited YesDisclosed NoAffects Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems (+8 more)Fix KB5122871, KB5124008, KB5122880 and 1 more
What you should do
If you run the affected products, install Microsoft's update (KB5122871, KB5124008, KB5122880 and 1 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix and reports this vulnerability as exploited, so it matters if you run the affected products.
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
Severity
Important · CVSS 7.8
Type
Security updates
Tags
Windows Update Stack, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: Yes · Publicly disclosed: No · Exploitation Detected · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Important) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002914, KB5002904 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+13 more)Fix KB5002914, KB5002904
What you should do
If you run the affected products, install Microsoft's update (KB5002914, KB5002904 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Graphics Component Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5002916, KB5122876, KB5122882 and others listed in the advisory and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+41 more)Fix KB5002916, KB5122876, KB5122882 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5002916, KB5122876, KB5122882 and others listed in the advisory and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Microsoft Graphics Component, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002914, KB5002904 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+13 more)Fix KB5002914, KB5002904
What you should do
If you run the affected products, install Microsoft's update (KB5002914, KB5002904 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Word Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002916 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+11 more)Fix KB5002916
What you should do
If you run the affected products, install Microsoft's update (KB5002916 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Word, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002914, KB5002904 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+13 more)Fix KB5002914, KB5002904
What you should do
If you run the affected products, install Microsoft's update (KB5002914, KB5002904 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002914, KB5002904 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+13 more)Fix KB5002914, KB5002904
What you should do
If you run the affected products, install Microsoft's update (KB5002914, KB5002904 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5002914, KB5002904 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+13 more)Fix KB5002914, KB5002904
What you should do
If you run the affected products, install Microsoft's update (KB5002914, KB5002904 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002914, KB5002904 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+13 more)Fix KB5002914, KB5002904
What you should do
If you run the affected products, install Microsoft's update (KB5002914, KB5002904 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.