NCSC-2026-0286 [1.00] [M/H] Vulnerabilities patched in Microsoft Office
Microsoft has patched vulnerabilities in various Office products. An attacker can exploit the vulnerabilities to conduct attacks that may result in the damage categories described in the table below. Successful exploitation requires the attacker to trick the victim into opening a malicious file or following a link. The table below mentions the vulnerability with identifier CVE-2026-65667 with a CVSS score of 10.0. It also lists vulnerabilities with identifiers CVE-2026-50515, CVE-2026-62896 and CVE-2026-70332, each with a CVSS score of 9 or higher. However, these vulnerabilities have already been centrally patched by Microsoft and are included for informational purposes only. No action is required for these. The vulnerability with identifier CVE-2026-70306 also has a CVSS score higher than 9 and does require action. This vulnerability is located in Sharepoint and allows an attacker to execute arbitrary code in the victim's context through a cross-site scripting attack.
Microsoft OneDrive: |----------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |----------------|------|-------------------------------------| | CVE-2026-65680 | 6.70 | Privilege escalation | |----------------|------|-------------------------------------| Azure SQL Managed Instance: |----------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |----------------|------|-------------------------------------| | CVE-2026-62836 | 8.70 | Privilege escalation | |----------------|------|-------------------------------------| Microsoft Teams for Android: |----------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |----------------|------|-------------------------------------| | CVE-2026-65768 | 8.80 | Arbitrary code execution | | CVE-2026-65767 | 8.80 | Impersonation of other users | |----------------|------|-
CSIRTS triage
- What
- Multiple vulnerabilities in Office products allow remote code execution and information disclosure; CVE-2026-70306 in SharePoint requires action.
- Who is affected
- Microsoft Office users and SharePoint deployments are affected; exploitation requires user interaction.
- Urgency
- High—CVE-2026-70306 (CVSS 9+) in SharePoint requires action and has not been pre-patched centrally.
- Action
- Prioritize patching of CVE-2026-70306 in SharePoint; verify status of other Office vulnerabilities.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Office and SharePoint
Get an email when a new Office and SharePoint advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0286
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-656670.44% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-505150.91% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 57% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-628960.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-703320.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-703060.73% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 51% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-656800.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-628360.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-657680.61% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 46% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-657670.44% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-629180.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
Referenced CVEs
+80 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Microsoft Office Products: Multiple Vulnerabilitiescert-bund
- unknownMultiple vulnerabilities in Microsoft Office (August 12, 2026)cert-fr-avis
- unknownMultiple vulnerabilities in Microsoft products (August 12, 2026)cert-fr-avis
- mediumCVE-2026-65680: Improper link resolution before file access ('link following') in Microsoft OneDrive allows an…nvd
- highCVE-2026-70355: Improper neutralization of input during web page generation ('cross-site scripting') in Micros…nvd
- highCVE-2026-70329: Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to …nvd
- mediumCVE-2026-70328: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose infor…nvd
- mediumCVE-2026-70327: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose infor…nvd
- highCVE-2026-70326: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacke…nvd
- mediumCVE-2026-70325: Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to di…nvd
- highCVE-2026-70324: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacke…nvd
- mediumCVE-2026-70323: Improper input validation in Microsoft Office allows an unauthorized attacker to disclose info…nvd
Recent advisories for Microsoft Office
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- high[NEW] [high] Microsoft Office Products: Multiple Vulnerabilitiescert-bund · 2026-08-13
- critical[NEW] [critical] Microsoft Office products: Multiple vulnerabilitiescert-bund · 2026-08-13
- unknownMultiple vulnerabilities in Microsoft Office (August 12, 2026)cert-fr-avis · 2026-08-12
- highCVE-2026-70355: Improper neutralization of input during web page generation ('cross-site scripting') in Micros…nvd · 2026-08-11
- highCVE-2026-70329: Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to …nvd · 2026-08-11
- mediumCVE-2026-70328: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose infor…nvd · 2026-08-11
More from NCSC-NL Advisories
- unknownNCSC-2026-0304 [1.00] [M/H] ZeroDay Vulnerability Fixed in GeoTools by OpenGeo2026-08-18
- unknownNCSC-2026-0303 [1.00] [M/H] Vulnerabilities Fixed in GitLab by GitLab Inc.2026-08-18
- unknownNCSC-2026-0302 [1.00] [M/H] Vulnerabilities patched in SAP Commerce Cloud Data Hub Adapter2026-08-15
- unknownNCSC-2026-0301 [1.00] [M/H] Vulnerabilities patched in IBM i operating system by IBM2026-08-14
- unknownNCSC-2026-0300 [1.00] [M/H] Vulnerabilities patched in Fortinet FortiWeb2026-08-13