CVE-2026-68804

This flaw is in Microsoft Excel/Microsoft Office’s handling of certain numbers when processing a document. An attacker can create a specially crafted file that, if opened, tricks the vulnerable program into running code on your device. Think of it like a document “smuggling” instructions that the app executes when you open the file.

This matters if your business uses Microsoft Excel or Microsoft Office (including Microsoft 365 Apps, Microsoft Office 2019/2021, and the Microsoft Office for Mac and LTSC variants listed). It also matters if you host Office Online Server.

Because the issue involves opening a crafted document, risk is tied to whether an attacker can send you a malicious file that your users open and whether your Office build is still before the fixed versions.

This is a RED issue because Microsoft has released fixes for multiple Office products and the tracked activity indicates a real attacker focus on this class of vulnerability. Even though there’s no public exploit code on record and no CISA KEV entry, you should treat this as an active, patch-needed risk for any system that hasn’t been updated yet.

1. Inventory affected software

• List every device/server where any of the following are installed/running: Microsoft 365 apps, Microsoft Excel, Microsoft Office, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server.

2. Check current versions (before patching)

• Windows/Microsoft Excel/Microsoft Office: record the installed Excel/Office build number from the app’s About page.
• macOS variants: record the build number from the Office app’s About page.
• Office Online Server: record the currently deployed build.

3. Determine whether you are vulnerable

• Microsoft Excel is fixed only at versions later than 16.0.5565.1001.
• macOS Office variants listed are fixed at 16.112.26081010.
• Office Online Server is fixed at 16.0.10417.20175.
• For Microsoft 365 Apps and Microsoft Office (Windows), apply the update referenced on Microsoft’s Office security release page for CVE-2026-68804.

4. Apply the patch

• Use Microsoft’s update guidance for CVE-2026-68804 and upgrade each product to its fixed version/build.

5. Validate

• Re-check the build number in each updated app to confirm it matches the fixed release.
• Open a representative mix of normal spreadsheets (including ones your business frequently receives externally) to confirm your environment behaves as expected.

6. If patching is delayed (workarounds)

• Reduce exposure to suspicious files immediately: restrict or closely review inbound Excel/Office attachments, and avoid opening unexpected documents from email or external sources.
• If your environment supports it, temporarily tighten attachment handling policies (e.g., block/unblock at the email gateway) until patches are installed.

7. What to monitor

• After deployment, monitor for any signs of Office-related compromise (unexpected processes launched by Office apps, unusual logins, new scheduled tasks/services) and review email/security alerts around document openings.

KEV/CISA note: not listed in CISA KEV (per current finding).

CVE-2026-68804 is a Microsoft Excel Remote Code Execution vulnerability involving a numeric truncation error (CWE-122 and CWE-197). The issue is associated with opening/processing a crafted Microsoft Office document that can lead to unauthorized code execution on vulnerable installs.

Exploitation status in findings: no public exploit code on record and no CISA KEV listing. EPSS was predicted at 0.4% with a flat trend, but public predictions are not treated as decisive here given the RED handling and the identified patch/actor-related press attention.

Patch availability: Microsoft released fixed versions for Microsoft Excel (16.0.5565.1001), multiple Microsoft Office for Mac/LTSC builds (16.112.26081010), and Office Online Server (16.0.10417.20175). The fix should be applied using Microsoft’s Office security release guidance for CVE-2026-68804.