CVE-2026-54131
Actively exploited. CVE-2026-54131 is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild, and US federal agencies are required to remediate it under BOD 22-01. Treat patching as urgent.
Multiple vulnerabilities have been discovered in Microsoft Office. They allow an attacker to cause remote arbitrary code execution, privilege escalation, and a data confidentiality breach.
CSIRTS triage
- What
- Multiple vulnerabilities could lead to remote code execution, privilege escalation, and data breaches.
- Who is affected
- Users of Microsoft Office.
- Urgency
- Remediation is critical due to the severity of the vulnerabilities.
- Action
- Users should apply the necessary updates to Microsoft Office.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-54131
Get an email if CVE-2026-54131 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Exploitation confirmedAlready exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 23% of all EPSS-scored CVEs.
Advisory coverage (6)
- unknownexploitedNCSC-2026-0237 [1.02] [H/H] Vulnerabilities Fixed in Microsoft Officencsc-nl · 2026-07-21
- unknownexploitedNCSC-2026-0237 [1.01] [H/H] Vulnerabilities fixed in Microsoft Officencsc-nl · 2026-07-17
- unknownMultiple vulnerabilities in Microsoft Office (July 15, 2026)cert-fr-avis · 2026-07-15
- unknownexploitedNCSC-2026-0237 [1.00] [M/H] Vulnerabilities fixed in Microsoft Officencsc-nl · 2026-07-14
- highCVE-2026-54131: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code local…nvd · 2026-07-14
- highCVE-2026-54131: Microsoft Excel Remote Code Execution Vulnerabilitymsrc · 2026-07-14
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-54131)