[NEW] [critical] Microsoft Office products: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in various Microsoft Office products to execute arbitrary code, disclose information, present false information, escalate privileges, and bypass security measures.
CSIRTS triage
- What
- Multiple vulnerabilities in various Microsoft Office products can be exploited to execute arbitrary code, disclose information, present false information, escalate privileges, and bypass security measures.
- Who is affected
- Users of Microsoft Office products are affected by these vulnerabilities.
- Urgency
- Remediation is critical due to the high severity and potential for exploitation of these vulnerabilities.
- Action
- Users should update their Microsoft Office products to the latest version.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Office products
Get an email when a new Office products advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2317
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-551310.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-551220.53% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-550530.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-551370.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-550580.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-550370.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-550460.54% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-558980.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-551380.54% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-550480.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
Referenced CVEs
+12 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedNCSC-2026-0237 [1.02] [H/H] Vulnerabilities Fixed in Microsoft Officencsc-nl
- unknownexploitedNCSC-2026-0237 [1.01] [H/H] Vulnerabilities fixed in Microsoft Officencsc-nl
- unknownMultiple vulnerabilities in Microsoft Office (July 15, 2026)cert-fr-avis
- unknownMultiple vulnerabilities in Microsoft products (July 15, 2026)cert-fr-avis
- unknownexploitedNCSC-2026-0237 [1.00] [M/H] Vulnerabilities fixed in Microsoft Officencsc-nl
- highCVE-2026-55949: Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to exe…nvd
- highCVE-2026-55947: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execut…nvd
- mediumCVE-2026-55898: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose infor…nvd
- mediumCVE-2026-55142: Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose …nvd
- highCVE-2026-55141: Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execu…nvd
- mediumCVE-2026-55138: Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to dis…nvd
- highCVE-2026-55137: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execut…nvd
Recent advisories for Microsoft Office products
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- high[NEW] [high] Microsoft Office Products: Multiple Vulnerabilitiescert-bund · 2026-08-21
More from CERT-Bund (BSI) Security Advisories
- high[UPDATE] [hoch] MISP: Mehrere Schwachstellen2026-09-07
- high[UPDATE] [hoch] Ollama: Schwachstelle ermöglicht Offenlegung von Informationen2026-09-07
- high[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen2026-09-07
- medium[UPDATE] [mittel] libssh2: Schwachstelle ermöglicht Denial of Service2026-09-07
- high[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen2026-09-07