CVE-2026-68815

Microsoft Excel Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 38th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile38th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-13Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your Microsoft Office/Excel version is earlier than the fixed releases for CVE-2026-68815.
Update Microsoft Excel/Microsoft 365 Apps and Microsoft Office (including Mac) to the fixed versions listed by Microsoft for CVE-2026-68815.
Verify Office updates are actually installed on all devices (not just the main desktop) and restart Office after updating.
Until updates are applied, reduce exposure by blocking or carefully handling unexpected Excel/Office attachments (especially from email or shared links) and using security controls your IT already has in place for file scanning and attachment filtering.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

In plain language

Written by AI from the record

CVE-2026-68815 is a Microsoft Excel issue where a specially crafted document can make your computer run harmful code when someone opens the file; this is a serious risk for any business that receives Office files from email, web downloads, or attachments, because it does not require login—only opening the file.

CVE-2026-68815 is a memory-handling weakness in Excel that can lead to local execution of attacker-controlled code when a user opens a malicious Office document (no authentication, but requires user interaction).

If you're affected

Full account compromise
Ransomware installation risk
Data theft from opened documents
System disruption

What is it

Imagine opening an Excel file that looks normal, but it secretly tricks Excel into running code on your computer. If a staff member opens that file, the attacker can act as that user—potentially installing malware, stealing data, or disrupting work.

Who is affected

This matters if your business uses Microsoft Excel or Microsoft Office on Windows or macOS (including Microsoft 365 Apps, Office 2019/2021/2024, and Office LTSC for Mac). The risk is primarily tied to whether someone could be tricked into opening a malicious Excel/Office document—there’s no need to log in first. If a malicious file is not reachable (for example, your organization blocks unsafe attachments and keeps Office fully updated), the exposure is lower; otherwise, treat this as a realistic email-attachment risk.

How urgent is it

This is urgent because attackers can use a crafted Excel file to execute code on a local machine when it’s opened. While no KEV listing is present and no clear dated incidents are mentioned in the provided reporting, Microsoft has released fixes and public interest is new—so prioritize updating to close this direct, user-interaction-based risk.

What to do — in detail

Confirm the exact product/version on each device
- On Windows: open Excel (or any Office app) and check the product/version from your Office About screen.
- On macOS: open one of the Office apps (Excel/Word) and check About to identify the build.
- Also check for “Microsoft 365 Apps” vs “Office LTSC” vs a specific Office perpetual version, because the fixed build differs.
Compare against Microsoft’s fixed versions for CVE-2026-68815
- Microsoft Excel: fixed in 16.0.5565.1001
- Microsoft 365 Apps: fixed as provided in Microsoft’s Office security releases page (see Microsoft update guide for CVE-2026-68815)
- Microsoft Office (Windows perpetual): fixed as provided in Microsoft’s Office security releases page (see Microsoft update guide for CVE-2026-68815)
- Microsoft Office 365 for Mac: fixed in 16.112.26081010
- Microsoft Office LTSC for Mac 2021: fixed in 16.112.26081010
- Microsoft Office LTSC for Mac 2024: fixed in 16.112.26081010
- Office Online Server: fixed in 16.0.10417.20175
Patch/upgrade
- Apply Microsoft’s update for CVE-2026-68815 to all impacted devices.
- After updating, restart Office apps and confirm the About screen now shows a build at or beyond the fixed versions listed above.
Temporary containment if patching is delayed
- Treat inbound Excel/Office files from external sources (email attachments, chat exports, shared links) as untrusted until machines are updated.
- Ensure attachment filtering and file scanning controls are enabled (for example, quarantine suspicious attachments), and confirm staff know not to open unexpected documents.
- If your environment supports it, restrict who can open external attachments and reduce risky download paths.
What to monitor after updates
- Look for Office/Excel-related crashes or unusual child processes immediately after opening external documents.
- Review email security logs for quarantined or blocked messages related to Office attachments, and ensure rules continue to function.
Deadline guidance
- No CISA due date is provided in the supplied findings.
- Given the RED verdict and Microsoft’s patch availability, aim to complete updates as a priority across all endpoints that run Office/Excel.

Technical context

CVE-2026-68815 is classified as a Remote Code Execution issue with CWE-122, describing a memory-handling problem in Microsoft Office Excel that can allow code execution with the permissions of the user who opens a malicious file. The findings indicate no authentication is required, but user interaction is required (a user must open the crafted document). Public exploitation details (including public exploit code) are not provided in the findings, KEV listing is not present, and the press reporting provided does not include a clear dated exploitation claim; however, PULSE notes increased actor interest (Lazarus group) and new patch-related attention. Microsoft has published fixes, including Excel fixed in 16.0.5565.1001 and specific macOS build 16.112.26081010 for the Mac Office lines. EPSS is provided as a prediction in the findings, but public blocks in this response avoid those numbers; the overall urgency is driven by the confirmed need to patch and the RED verdict.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS38th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 38th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 2 days, from the signal feeds we watch.

2026-08-13OpenVAS check addedpatch available, record updated
2026-08-12Patch availablerecord updated, record updated, record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US
- Microsoft 365 Apps for EnterpriseDesktop AppConsumer Software / productivity
- Microsoft Excel 2016Desktop AppConsumer Software / productivity
- Microsoft Office LTSC 2021Desktop AppConsumer Software / productivity
- Microsoft Office 365 for MacDesktop AppOn-premConsumer Software / productivity
- Microsoft Office LTSC for Mac 2021Desktop AppOn-premConsumer Software / productivity
- Microsoft Office LTSC for Mac 2024Desktop AppOn-premConsumer Software / productivity
- Office Online ServerWeb AppOn-premEnterprise Software / collaboration-groupware
- microsoft 365SaaS ServiceSaaSCloud & SaaS / saas-application

And 7 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable