CVE-2026-68794

Microsoft Excel Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 38th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile38th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-13Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which Microsoft products you run (Microsoft Excel/Microsoft Office, Microsoft 365 Apps, Office on the Mac, and/or Office Online Server) and the installed version/build.
Verify whether your build is below the fixed versions listed by Microsoft (Windows/Excel fixed in 16.0.5565.1001; Mac fixed in 16.112.26081010; Office Online Server fixed in 16.0.10417.20175).
Update Microsoft Office/Microsoft Excel to the fixed release for your product using Microsoft’s Office security release guidance (Microsoft 365 Apps and Microsoft Office use the Microsoft OfficeSecurityReleases update path).
For any devices you can’t update immediately, restrict users from opening files from untrusted email/links and isolate any workstation that receives suspicious Office documents until updates are applied.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

In plain language

Written by AI from the record

CVE-2026-68794 is a Microsoft Excel/Office flaw where a specially made file can cause harmful code to run on your computer when a user opens it; because Microsoft has a fix, typical small businesses should patch promptly.

CVE-2026-68794 is a heap-based buffer overflow in Microsoft Office Excel that can lead to local code execution after a user opens a crafted file (unauthorized attacker, but requires user interaction).

If you're affected

Malware running on workstations
Data theft from Office files
Business disruption from compromise
Wider ransomware risk

What is it

Think of this like a “crash-and-takeover” bug in Excel: a malicious, specially crafted document can trigger a memory error. If the document is opened, that bug can be used to run harmful code on the same computer. The impact is similar to giving malware a door into the machine through an Excel file.

Who is affected

This matters if your business uses Microsoft Excel or Microsoft Office (including Microsoft 365 Apps, Microsoft Office 365 for Mac, and the Mac LTSC versions) and users open Office documents on affected systems. It can also matter if you run Office Online Server, since that product also has a fixed version. Practical risk is higher when attackers can get a user to open a malicious Excel/Office file (user interaction), even though it doesn’t require a login.

How urgent is it

This is RED because Microsoft has released fixes and security research/press attention ties this to an advanced actor (Lazarus group), which increases the real-world likelihood of targeted attempts. Even without public exploit code available, this type of Office memory bug can be weaponized into code execution when users open a crafted file, so patching should happen immediately.

What to do — in detail

Inventory what you’re running
- Identify where Microsoft Office/Excel is installed: Windows desktops, macOS desktops, and any Office Online Server instance.
- Note the installed version/build for each device (and whether it’s Microsoft 365 Apps, Office 2019/2021, or LTSC for Mac).
Determine exposure using Microsoft’s fixed versions
- Microsoft Excel: fixed in 16.0.5565.1001.
- Microsoft Office 365 for Mac: fixed in 16.112.26081010.
- Microsoft Office LTSC for Mac 2021: fixed in 16.112.26081010.
- Microsoft Office LTSC for Mac 2024: fixed in 16.112.26081010.
- Office Online Server: fixed in 16.0.10417.20175.
- Microsoft 365 Apps and Microsoft Office: upgrade per Microsoft’s Office security release guidance (OfficeSecurityReleases).
Patch/upgrade
- Update each affected device to the fixed build listed above for that platform.
- For Microsoft 365 Apps/Microsoft Office on Windows, follow Microsoft’s guidance at the OfficeSecurityReleases update path and ensure you land on the patched release for CVE-2026-68794.
If you can’t update right away (temporary containment)
- Enforce “don’t open” handling for unsolicited attachments and links.
- Restrict or block email attachment types that can deliver Excel payloads until updates are complete.
- Triage any endpoint that opened a suspicious Office file: isolate the workstation from the network and review endpoint security alerts.
After patching
- Confirm version/build changed to at least the fixed version for each product family.
- Watch email/security logs for repeated attempts using Office attachments related to current campaigns (especially around the time of the update rollout).
KEV/CISA note
- This CVE was not found in the CISA KEV list based on the provided findings, so treat the Microsoft patch as the primary authoritative remediation step.

Technical context

Severity is rated HIGH (CVSS 7.8 in the provided information). The weakness is CWE-122, associated with memory corruption bugs; the backstop indicates a heap-based buffer overflow in Microsoft Office Excel. The attack pattern from the provided CVSS indicates an attacker does not need a valid login (PR:N), but the user must interact (UI:R), consistent with exploitation via a crafted Office document that the victim opens. No public exploit code is on record, and this is not listed in KEV per the findings; however, press attention cites Lazarus group activity and Microsoft has published targeted fixed builds. Exploit maturity is not confirmed by a public exploit release or KEV inclusion in the findings, so patching should focus on the available Microsoft remediations rather than waiting for additional public proof.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS38th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 38th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

10 events over 2 days, from the signal feeds we watch.

2026-08-13OpenVAS check addedpatch available, record updated
2026-08-12Patch availablerecord updated, record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US
- Microsoft 365 Apps for EnterpriseDesktop AppConsumer Software / productivity
- Microsoft Excel 2016Desktop AppConsumer Software / productivity
- Microsoft Office LTSC 2021Desktop AppConsumer Software / productivity
- Microsoft Office 365 for MacDesktop AppOn-premConsumer Software / productivity
- Microsoft Office LTSC for Mac 2021Desktop AppOn-premConsumer Software / productivity
- Microsoft Office LTSC for Mac 2024Desktop AppOn-premConsumer Software / productivity
- Office Online ServerWeb AppOn-premEnterprise Software / collaboration-groupware
- microsoft 365SaaS ServiceSaaSCloud & SaaS / saas-application

And 7 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable