[NEW] [critical] Microsoft Office products: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in various Microsoft Office products to execute arbitrary code, disclose information, present false information, escalate privileges, and bypass security measures.
CSIRTS triage
- What
- Multiple vulnerabilities in various Microsoft Office products can be exploited to execute arbitrary code, disclose information, present false information, escalate privileges, and bypass security measures.
- Who is affected
- Users of Microsoft Office products are affected by these vulnerabilities.
- Urgency
- Remediation is critical due to the high severity and potential for exploitation of these vulnerabilities.
- Action
- Users should update their Microsoft Office products to the latest version.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Office products
Get an email when a new Office products advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2317
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-551310.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all scored CVEs.
- Low exploitation riskCVE-2026-551220.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all scored CVEs.
- Low exploitation riskCVE-2026-550530.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all scored CVEs.
- Low exploitation riskCVE-2026-551370.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all scored CVEs.
- Low exploitation riskCVE-2026-550580.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all scored CVEs.
- Low exploitation riskCVE-2026-550370.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all scored CVEs.
- Low exploitation riskCVE-2026-550460.46% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all scored CVEs.
- Low exploitation riskCVE-2026-558980.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all scored CVEs.
- Low exploitation riskCVE-2026-551380.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all scored CVEs.
- Low exploitation riskCVE-2026-550480.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all scored CVEs.
Referenced CVEs
+12 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedNCSC-2026-0237 [1.02] [H/H] Vulnerabilities Fixed in Microsoft Officencsc-nl
- unknownexploitedNCSC-2026-0237 [1.01] [H/H] Vulnerabilities fixed in Microsoft Officencsc-nl
- unknownMultiple vulnerabilities in Microsoft products (July 15, 2026)cert-fr-avis
- unknownMultiple vulnerabilities in Microsoft Office (July 15, 2026)cert-fr-avis
- unknownexploitedNCSC-2026-0237 [1.00] [M/H] Vulnerabilities fixed in Microsoft Officencsc-nl
- highCVE-2026-55949: Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to exe…nvd
- highCVE-2026-55947: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execut…nvd
- mediumCVE-2026-55898: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose infor…nvd
- mediumCVE-2026-55142: Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose …nvd
- highCVE-2026-55141: Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execu…nvd
- mediumCVE-2026-55138: Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to dis…nvd
- highCVE-2026-55137: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execut…nvd
More from CERT-Bund (BSI) Security Advisories
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-31
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow Denial of Service2026-07-31
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-31
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities2026-07-31
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow unspecified attack2026-07-31