CVE-2026-68807

Microsoft Excel Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 38th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile38th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-13Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether any affected Microsoft Office/Excel apps on your business devices are at or below the fixed versions (Windows Excel: 16.0.5565.1001; Mac Office/Excel: 16.112.26081010; Office Online Server: 16.0.10417.20175).
Update Microsoft Excel/Microsoft Office (including Microsoft 365 Apps) to the fixed builds listed by Microsoft for CVE-2026-68807.
For devices where patching is delayed, block or quarantine unexpected spreadsheet files from email and downloads (especially files from new or untrusted senders) until updates are applied.
After updating, verify your version number changed to the fixed build on each endpoint and review email/security logs for suspicious Excel attachments.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

In plain language

Written by AI from the record

CVE-2026-68807 is a Microsoft Excel bug that can let someone run harmful code on your computer if you open a specially crafted Excel file; if you receive unexpected spreadsheets, you should treat this as urgent and update.

CVE-2026-68807 is a Microsoft Excel memory-corruption weakness (CWE-122) that can lead to local remote code execution when a victim opens a malicious Excel file, without needing any login beforehand.

If you're affected

Full computer compromise
Malware installation
Data theft risk
Ransomware risk

What is it

This is a flaw in Microsoft Excel that can be triggered by a “booby-trapped” spreadsheet. If someone sends you that file and you open it, the file can cause Excel to run code on your computer—like giving an attacker a foothold inside your business device.

Who is affected

This matters if your business uses Microsoft Excel (including Microsoft 365 Apps / Microsoft Office) on Windows or macOS, or if you run Office Online Server. The key risk is user action: an attacker needs you to open a malicious file in Excel.

There’s no risk from the office software just being installed; it becomes a concern when a crafted Excel file is opened by a user.

How urgent is it

This is RED because it’s a remote code execution flaw that can run code on a user’s machine simply by opening a malicious Excel file. Public “KEV” confirmation wasn’t provided for this specific CVE, but security attention is already driving patching, including threat-actor-related reporting, so you should treat it as actively important to remediate now.

What to do — in detail

Identify affected software and current versions
- On Windows endpoints: check Microsoft Excel version on machines that use Excel (this CVE’s Windows Excel fix is 16.0.5565.1001).
- On macOS endpoints: check the Microsoft Office build (the fixed Office for Mac / LTSC for Mac build is 16.112.26081010).
- For server deployments: if you run Office Online Server, check its build (fixed in 16.0.10417.20175).
Compare against Microsoft’s fixed versions
- Update any endpoints not yet at the fixed builds listed for CVE-2026-68807.
- Microsoft’s update guidance is available via the Microsoft Update Guide pages linked in the findings (CVE-2026-68807).
Upgrade/patch
- Apply Microsoft’s recommended Office updates for the corresponding product and platform.
- Roll out in a controlled way (prioritize devices used for email, file downloads, and external document review).
Temporary mitigation if patching is delayed
- Quarantine or restrict opening of spreadsheet attachments from untrusted sources.
- Tighten email handling for unexpected Excel files (especially from new senders or irregular business contacts) until patches are installed.
Validate and monitor
- Re-check versions after patching to confirm the fixed build is installed.
- Review recent logs (email/security gateway, endpoint alerts) for suspicious Excel attachments and any related user activity around the time those files were opened.

Technical context

CVE-2026-68807 is a Microsoft Excel issue mapped to CWE-122, described as a heap-based buffer overflow leading to arbitrary code execution locally. The findings specify no authentication is required and user interaction is required via opening a malicious Excel file.

Exploitation status: there is no CISA KEV listing provided for this specific CVE, and no public exploit code was identified in the provided findings. However, security reporting indicates patch-focused attention and a threat-actor-related context (Lazarus group) in the findings, supporting a high-priority remediation posture for endpoints that can open untrusted spreadsheets.

Fix availability: specific fixed builds are identified for Microsoft Excel (16.0.5565.1001), Microsoft Office for Mac/LTSC for Mac (16.112.26081010), and Office Online Server (16.0.10417.20175), with Microsoft 365 Apps/other Microsoft Office variants directed to the Office security releases page for CVE-2026-68807.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS38th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 38th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 2 days, from the signal feeds we watch.

2026-08-13OpenVAS check addedpatch available, record updated
2026-08-12Patch availablerecord updated, record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US
- Microsoft 365 Apps for EnterpriseDesktop AppConsumer Software / productivity
- Microsoft Excel 2016Desktop AppConsumer Software / productivity
- Microsoft Office LTSC 2021Desktop AppConsumer Software / productivity
- Microsoft Office 365 for MacDesktop AppOn-premConsumer Software / productivity
- Microsoft Office LTSC for Mac 2021Desktop AppOn-premConsumer Software / productivity
- Microsoft Office LTSC for Mac 2024Desktop AppOn-premConsumer Software / productivity
- Office Online ServerWeb AppOn-premEnterprise Software / collaboration-groupware
- microsoft 365SaaS ServiceSaaSCloud & SaaS / saas-application

And 7 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable