NCSC-2026-0237 [1.01] [H/H] Vulnerabilities fixed in Microsoft Office
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Microsoft has fixed vulnerabilities in various Office products, such as Word, Excel, PowerPoint, and SharePoint. An attacker can exploit the vulnerabilities to carry out attacks that can lead to categories of damage, as listed in the table below. For successful exploitation, the attacker must deceive the victim into opening a malicious file or following a link, except for SharePoint. For successful exploitation of vulnerabilities in SharePoint, no user interaction is required other than following a malicious link. UPDATE: Microsoft has confirmed in an update that the SharePoint vulnerability CVE-2026-58644 has been actively exploited as a zero-day. The NCSC recommends updating vulnerable SharePoint systems to the latest version as soon as possible to prevent exploitation. The vulnerability CVE-2026-58644 concerns a deserialization vulnerability that could be exploited to execute code remotely. The vulnerability CVE-2026-58644 may be exploited in conjunction with the SharePoint vulnerability CVE-2026-56164 by an attacker to execute code remotely without authentication. The vulnerability CVE-2026-56164 concerns a privilege escalation vulnerability that could be exploited to elevate rights within a network.
CSIRTS triage
- What
- Microsoft has fixed vulnerabilities in various Office products that can be exploited to execute code.
- Who is affected
- Users of Microsoft Office products, particularly SharePoint, are affected.
- Urgency
- Remediation is urgent due to active exploitation of a zero-day vulnerability in SharePoint.
- Action
- Update vulnerable Office products to the latest version immediately.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Office
Get an email when a new Office advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0237
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-58644Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 93% of all scored CVEs.
- Exploitation confirmedCVE-2026-56164Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 97% of all scored CVEs.
- Exploitation confirmedCVE-2026-54108Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 52% of all scored CVEs.
- Exploitation confirmedCVE-2026-50522Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 99% of all scored CVEs.
- Exploitation confirmedCVE-2026-55016Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 34% of all scored CVEs.
- Exploitation confirmedCVE-2026-55019Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 43% of all scored CVEs.
- Exploitation confirmedCVE-2026-55020Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 34% of all scored CVEs.
- Exploitation confirmedCVE-2026-55021Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 48% of all scored CVEs.
- Exploitation confirmedCVE-2026-55030Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 43% of all scored CVEs.
- Exploitation confirmedCVE-2026-55034Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 55% of all scored CVEs.
- Exploitation confirmedCVE-2026-55126Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now.
- Exploitation confirmedCVE-2026-55051Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now.
Referenced CVEs
+46 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedSecurity Alert: [Updated] Microsoft Releases July 2026 Security Updatesjpcert
- criticalexploitedMicrosoft security advisory – July 2026 monthly rollup (AV26-698) – Update 3cccs
- critical[NEW] [critical] Microsoft Office products: Multiple vulnerabilitiescert-bund
- criticalexploited2026-009: Critical Vulnerabilities in Microsoft SharePointcert-eu
- highexploitedCISA Adds Two Known Exploited Vulnerabilities to Catalogcisa
- unknownexploitedMultiple vulnerabilities in Microsoft Sharepoint (July 22, 2026)cert-fr-alerte
- criticalexploitedCVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerabilitycisa-kev
- unknownexploitedNCSC-2026-0237 [1.02] [H/H] Vulnerabilities Fixed in Microsoft Officencsc-nl
- highexploitedCISA Adds Three Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2026-58644: Microsoft SharePoint Deserialization of Untrusted Data Vulnerabilitycisa-kev
- criticalexploitedAL26-017 - Critical vulnerabilities impacting Microsoft SharePoint Server – CVE-2026-56164, CVE-2026-55040 and…cccs
- unknownMicrosoft Monthly Security Update (July 2026)hkcert
More from NCSC-NL Advisories
- unknownNCSC-2026-0274 [1.00] [M/H] Kwetsbaarheid verholpen in SolarWinds Web Help Desk2026-07-31
- unknownNCSC-2026-0273 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Campaign Classic2026-07-31
- unknownNCSC-2026-0272 [1.00] [M/H] Kwetsbaarheden verholpen in JFrog Artifactory2026-07-31
- unknownNCSC-2026-0271 [1.00] [M/H] Vulnerability fixed in Cisco Secure Firewall Management Center2026-07-30
- unknownNCSC-2026-0270 [1.00] [M/M] Vulnerabilities fixed in GitLab by GitLab Inc.2026-07-30