NCSC-2026-0237 [1.02] [H/H] Vulnerabilities Fixed in Microsoft Office
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Microsoft has fixed vulnerabilities in various Office products, such as Word, Excel, PowerPoint, and SharePoint. An attacker can exploit these vulnerabilities to carry out attacks that may lead to categories of damage, as outlined in the table below. For successful exploitation, the attacker must deceive the victim into opening a malicious file or following a link, except for SharePoint. Successful exploitation of vulnerabilities in SharePoint does not require user interaction, other than following a malicious link. Microsoft has confirmed in an update that the SharePoint vulnerability CVE-2026-58644 has been actively exploited as a zero-day. The NCSC recommends updating vulnerable SharePoint systems to the latest version as soon as possible to prevent exploitation. The vulnerability CVE-2026-58644 is a deserialization vulnerability that could be exploited to execute code remotely. The vulnerability CVE-2026-58644 may be exploited in conjunction with the SharePoint vulnerability CVE-2026-56164 by an attacker to execute code remotely without authentication. The vulnerability CVE-2026-56164 is a privilege escalation vulnerability that could be exploited to elevate rights within a network. UPDATE: According to watchTowr, a public exploit code for the SharePoint vulnerability CVE-2026-50522 has been published and is now actively exploited on on-premise versions of SharePoint. Malicious actors can exploit this vulnerability to gain long-term access to networks of vulnerable systems by stealing machine keys.
Microsoft Office SharePoint: |----------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |----------------|------|-------------------------------------| | CVE-2026-54108 | 6.50 | Impersonate another user | | CVE-2026-56164 | 5.30 | Gain elevated rights | | CVE-2026-5052
CSIRTS triage
- What
- A deserialization vulnerability in SharePoint can be exploited to execute code remotely.
- Who is affected
- Deployments of SharePoint that are vulnerable to CVE-2026-58644.
- Urgency
- Remediation is urgent due to active exploitation of the vulnerability as a zero-day.
- Action
- Update vulnerable SharePoint systems to the latest version as soon as possible.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch SharePoint
Get an email when a new SharePoint advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0237
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-58644Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 93% of all scored CVEs.
- Exploitation confirmedCVE-2026-56164Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 97% of all scored CVEs.
- Exploitation confirmedCVE-2026-50522Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 99% of all scored CVEs.
- Exploitation confirmedCVE-2026-54108Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 52% of all scored CVEs.
- Exploitation confirmedCVE-2026-55016Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 34% of all scored CVEs.
- Exploitation confirmedCVE-2026-55019Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 43% of all scored CVEs.
- Exploitation confirmedCVE-2026-55020Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 34% of all scored CVEs.
- Exploitation confirmedCVE-2026-55021Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 48% of all scored CVEs.
- Exploitation confirmedCVE-2026-55030Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 43% of all scored CVEs.
- Exploitation confirmedCVE-2026-55034Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 55% of all scored CVEs.
- Exploitation confirmedCVE-2026-55126Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now.
- Exploitation confirmedCVE-2026-55051Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now.
Referenced CVEs
+46 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedSecurity Alert: [Updated] Microsoft Releases July 2026 Security Updatesjpcert
- criticalexploitedMicrosoft security advisory – July 2026 monthly rollup (AV26-698) – Update 3cccs
- critical[NEW] [critical] Microsoft Office products: Multiple vulnerabilitiescert-bund
- criticalexploited2026-009: Critical Vulnerabilities in Microsoft SharePointcert-eu
- highexploitedCISA Adds Two Known Exploited Vulnerabilities to Catalogcisa
- unknownexploitedMultiple vulnerabilities in Microsoft Sharepoint (July 22, 2026)cert-fr-alerte
- criticalexploitedCVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerabilitycisa-kev
- unknownexploitedNCSC-2026-0237 [1.01] [H/H] Vulnerabilities fixed in Microsoft Officencsc-nl
- highexploitedCISA Adds Three Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2026-58644: Microsoft SharePoint Deserialization of Untrusted Data Vulnerabilitycisa-kev
- criticalexploitedAL26-017 - Critical vulnerabilities impacting Microsoft SharePoint Server – CVE-2026-56164, CVE-2026-55040 and…cccs
- unknownMicrosoft Monthly Security Update (July 2026)hkcert
Recent advisories for Microsoft Office
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- critical[NEW] [critical] Microsoft Office products: Multiple vulnerabilitiescert-bund · 2026-07-23
- high[NEW] [high] Microsoft Office 365 (Moodle Plugin): Vulnerability allows bypassing of security measurescert-bund · 2026-07-17
- unknownexploitedNCSC-2026-0237 [1.01] [H/H] Vulnerabilities fixed in Microsoft Officencsc-nl · 2026-07-17
- mediumCVE-2026-62826: Improper neutralization of input during web page generation ('cross-site scripting') in Micros…nvd · 2026-07-16
- unknownCVE-2026-54733: The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Activ…nvd · 2026-07-16
- unknownMultiple vulnerabilities in Microsoft Office (July 15, 2026)cert-fr-avis · 2026-07-15
More from NCSC-NL Advisories
- unknownNCSC-2026-0274 [1.00] [M/H] Kwetsbaarheid verholpen in SolarWinds Web Help Desk2026-07-31
- unknownNCSC-2026-0273 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Campaign Classic2026-07-31
- unknownNCSC-2026-0272 [1.00] [M/H] Kwetsbaarheden verholpen in JFrog Artifactory2026-07-31
- unknownNCSC-2026-0271 [1.00] [M/H] Vulnerability fixed in Cisco Secure Firewall Management Center2026-07-30
- unknownNCSC-2026-0270 [1.00] [M/M] Vulnerabilities fixed in GitLab by GitLab Inc.2026-07-30