NCSC-2026-0237 [1.00] [M/H] Vulnerabilities fixed in Microsoft Office
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Microsoft has fixed vulnerabilities in various Office products, such as Word, Excel, PowerPoint, and SharePoint. An attacker can exploit the vulnerabilities to carry out attacks that can lead to categories of damage, as mentioned in the table below. For successful exploitation, the attacker must deceive the victim into opening a malicious file or following a link, except for SharePoint. For successful exploitation of vulnerabilities in SharePoint, no user interaction is needed other than following a malicious link.
CSIRTS triage
- What
- Microsoft has fixed vulnerabilities in various Office products that can be exploited by attackers.
- Who is affected
- Users of Microsoft Office products such as Word, Excel, PowerPoint, and SharePoint.
- Urgency
- Remediation is urgent due to active exploitation of these vulnerabilities.
- Action
- Users should apply the latest patches provided by Microsoft.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Office
Get an email when a new Office advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0237
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-54108Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 52% of all scored CVEs.
- Exploitation confirmedCVE-2026-56164Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 97% of all scored CVEs.
- Exploitation confirmedCVE-2026-50522Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 99% of all scored CVEs.
- Exploitation confirmedCVE-2026-58644Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 93% of all scored CVEs.
- Exploitation confirmedCVE-2026-55016Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 34% of all scored CVEs.
- Exploitation confirmedCVE-2026-55019Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 43% of all scored CVEs.
- Exploitation confirmedCVE-2026-55020Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 34% of all scored CVEs.
- Exploitation confirmedCVE-2026-55021Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 48% of all scored CVEs.
- Exploitation confirmedCVE-2026-55030Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 43% of all scored CVEs.
- Exploitation confirmedCVE-2026-55034Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 55% of all scored CVEs.
- Exploitation confirmedCVE-2026-55126Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now.
- Exploitation confirmedCVE-2026-55051Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now.
Referenced CVEs
+46 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedSecurity Alert: [Updated] Microsoft Releases July 2026 Security Updatesjpcert
- criticalexploitedMicrosoft security advisory – July 2026 monthly rollup (AV26-698) – Update 3cccs
- critical[NEW] [critical] Microsoft Office products: Multiple vulnerabilitiescert-bund
- criticalexploited2026-009: Critical Vulnerabilities in Microsoft SharePointcert-eu
- highexploitedCISA Adds Two Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerabilitycisa-kev
- unknownexploitedMultiple vulnerabilities in Microsoft Sharepoint (July 22, 2026)cert-fr-alerte
- unknownexploitedNCSC-2026-0237 [1.02] [H/H] Vulnerabilities Fixed in Microsoft Officencsc-nl
- unknownexploitedNCSC-2026-0237 [1.01] [H/H] Vulnerabilities fixed in Microsoft Officencsc-nl
- highexploitedCISA Adds Three Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2026-58644: Microsoft SharePoint Deserialization of Untrusted Data Vulnerabilitycisa-kev
- criticalexploitedAL26-017 - Critical vulnerabilities impacting Microsoft SharePoint Server – CVE-2026-56164, CVE-2026-55040 and…cccs
Recent advisories for Microsoft Office
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- critical[NEW] [critical] Microsoft Office products: Multiple vulnerabilitiescert-bund · 2026-07-23
- unknownexploitedNCSC-2026-0237 [1.02] [H/H] Vulnerabilities Fixed in Microsoft Officencsc-nl · 2026-07-21
- high[NEW] [high] Microsoft Office 365 (Moodle Plugin): Vulnerability allows bypassing of security measurescert-bund · 2026-07-17
- unknownexploitedNCSC-2026-0237 [1.01] [H/H] Vulnerabilities fixed in Microsoft Officencsc-nl · 2026-07-17
- mediumCVE-2026-62826: Improper neutralization of input during web page generation ('cross-site scripting') in Micros…nvd · 2026-07-16
- unknownCVE-2026-54733: The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Activ…nvd · 2026-07-16
More from NCSC-NL Advisories
- unknownNCSC-2026-0274 [1.00] [M/H] Kwetsbaarheid verholpen in SolarWinds Web Help Desk2026-07-31
- unknownNCSC-2026-0273 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Campaign Classic2026-07-31
- unknownNCSC-2026-0272 [1.00] [M/H] Kwetsbaarheden verholpen in JFrog Artifactory2026-07-31
- unknownNCSC-2026-0271 [1.00] [M/H] Vulnerability fixed in Cisco Secure Firewall Management Center2026-07-30
- unknownNCSC-2026-0270 [1.00] [M/M] Vulnerabilities fixed in GitLab by GitLab Inc.2026-07-30