CVE-2026-68816

Microsoft Excel Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 38th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile38th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-13Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check the exact version/build of your Microsoft Excel/Office installations (Windows desktop, Mac desktop, and Office Online Server if you host it).
If you use Microsoft Excel on Windows, update to Excel 16.0.5565.1001.
If you use Microsoft 365 Apps / Microsoft Office on Windows, update using the Microsoft Office security updates for CVE-2026-68816 (see Microsoft’s OfficeSecurityReleases update guidance).
If you use Microsoft Excel/Office on Mac, update to Microsoft Office 365 for Mac / Office LTSC for Mac 2021 / Office LTSC for Mac 2024 fixed at 16.112.26081010.
If you run Office Online Server, update it to 16.0.10417.20175.
After updating, restart Microsoft Office and verify the new version/build number still matches the fixed target.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

In plain language

Written by AI from the record

CVE-2026-68816 is a Microsoft Excel/Office bug that could let an attacker run code when you open a specially made file; if you use Microsoft Office, you should update to the fixed versions—this is a high-severity issue.

CVE-2026-68816 is a Microsoft Excel/Office vulnerability involving a stack-based buffer overflow (CWE-121) that can be triggered by a crafted input file, allowing unauthorized remote code execution in supported Microsoft Office/Excel components.

If you're affected

Malware execution on your PC
Full compromise of device account
Data theft from Office documents
Business disruption from ransomware

What is it

This vulnerability is like a “crashable weakness” in how Microsoft Excel/Office processes a file. An attacker could craft a document so that, when someone opens it, the bug lets malicious code run on the device. Think of it as a booby-trapped document that turns a normal “open file” action into an execution opportunity.

Who is affected

This matters to you if your business uses Microsoft Excel or Microsoft Office on Windows or Mac, or if you run Office Online Server. Because this is a file-triggered code execution issue, the risk increases when staff open emails or downloaded documents from untrusted sources. You should treat it as urgent unless you can confirm you are fully on the fixed versions, since the weakness is in common Office components and can be reachable via crafted content.

How urgent is it

This is RED: attackers have been linked in press attention (actor: Lazarus group) and Microsoft has provided fixes, which is a strong signal this is not just theoretical. Even without public exploit code on record, a code-execution bug in Office is exactly the kind that gets targeted through crafted documents. Update as soon as possible to eliminate the known vulnerable builds.

What to do — in detail

Confirm whether you’re exposed

Windows (Microsoft Excel / Microsoft 365 Apps / Microsoft Office): Check the Office build/version number in Excel (File → Account → About Excel). Record the version.
Mac (Microsoft Office / Excel): Check the Office version/build in one of the Office apps (often under Help → About).
Office Online Server: Check your deployed build/version for the server.

Upgrade targets (apply what matches your environment)

Microsoft Excel (Windows desktop): Upgrade to 16.0.5565.1001.
Microsoft 365 Apps / Microsoft Office (Windows desktop): Upgrade via Microsoft’s Office security update guidance for this CVE (follow https://aka.ms/OfficeSecurityReleases and the CVE entry on https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68816).
Microsoft Office on Mac (covered SKUs): Upgrade to 16.112.26081010.
- Microsoft Office 365 for Mac
- Microsoft Office LTSC for Mac 2021
- Microsoft Office LTSC for Mac 2024
Office Online Server: Upgrade to 16.0.10417.20175.

If you can’t patch immediately

Reduce exposure right now: Stop users from opening unexpected Excel/Office files from email, links, or downloads until the update is applied.
Tighten file handling: Prefer using the browser/editor on trusted channels and avoid opening attachments from unknown senders.

What to monitor after updating

Confirm the updated build/version is actually installed across endpoints.
Watch for unusual Office-related behavior (e.g., unexpected prompts or processes spawned when opening documents) and report any suspicious files back to IT/security.

Technical context

Severity is high (CVSS 7.8 reported in the source set) and the weakness is CWE-121 (Stack-based buffer overflow). The vulnerability is described as a Microsoft Office Excel issue that can enable remote code execution when an attacker supplies a crafted file; in practice, the triggering mechanism is malformed content processed by Excel/Office that causes memory corruption.

Exploit status: no public exploit code on record (from the findings) and not listed in CISA KEV. Press attention indicates patch-related activity and an actor mention (Lazarus group), and Microsoft has published fix guidance for multiple Office/Excel products and Office Online Server.

Fix availability: fixed versions are provided for Excel on Windows (16.0.5565.1001), Office on Mac (16.112.26081010), and Office Online Server (16.0.10417.20175), with additional Windows suite updates guided via Microsoft’s OfficeSecurityReleases pages for CVE-2026-68816. The predicted likelihood (EPSS) is provided as a forecast only; it is not treated as proof of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS38th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 38th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 2 days, from the signal feeds we watch.

2026-08-13OpenVAS check addedpatch available, record updated
2026-08-12Patch availablerecord updated, record updated, record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US
- Microsoft 365 Apps for EnterpriseDesktop AppConsumer Software / productivity
- Microsoft Excel 2016Desktop AppConsumer Software / productivity
- microsoft 365SaaS ServiceSaaSCloud & SaaS / saas-application
- office 2019Desktop AppOn-premConsumer Software / productivity
- office 2021Desktop AppOn-premConsumer Software / productivity
- office 2024Desktop AppOn-premConsumer Software / productivity
- Microsoft Office LTSC 2021Desktop AppConsumer Software / productivity
- Microsoft Office 365 for MacDesktop AppOn-premConsumer Software / productivity

And 7 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable