CVE-2026-81953

This vulnerability is a flaw in how Excel handles certain spreadsheet content. If a user opens a specially made Excel file, it could let an attacker run malicious code on that user’s computer—like turning a harmless document into a delivery vehicle for malware.

This matters if your business uses Microsoft Excel or Microsoft Office on Windows or Mac, including Microsoft 365 Apps and the supported Office 2016/2019/2021/2024 and Mac Office LTSC/Office 365 for Mac products listed.

It’s primarily a risk when an attacker can trick someone into opening a crafted spreadsheet file (user interaction is required). There’s no indication from the findings that exploitation happens without a user opening a malicious document.

Verdict: RED. Even though there’s no KEV listing and no public exploit code on record, this is a serious remote code execution risk tied to opening a malicious Excel file, and Microsoft has already provided fixes.

Act now to reduce the chance that a staff member opening a booby-trapped spreadsheet could lead to malware execution.

Confirm exposure

1. Identify which Office/Excel product you run on each device (for example: Microsoft 365 Apps vs Office 2016/2019/2021/2024, and whether it’s Windows or Mac). Also confirm the installed Office version/build.
2. On each device, verify whether it’s already on or above one of the fixed builds listed by Microsoft for your specific product/channel.

Upgrade to the fixed version

Use the fixed versions provided by Microsoft for CVE-2026-81953:

• Microsoft 365 Apps: 16.0.20326.20138 (or later)
• Microsoft Excel: 16.0.5569.1003 (or later)
• Microsoft Office: fixed builds include 16.0.5569.1003, 16.0.10417.20207, 16.0.14334.20906, and 16.0.17932.20976 (or later), depending on your Office release channel.

Breaking-change / rollout notes

• Microsoft Office updates typically apply cleanly, but you should schedule rollout in a maintenance window and validate with a small user group first if you have strict change-control.

Temporary workaround (if patching is delayed)

• Restrict opening external spreadsheet attachments: block or quarantine unknown spreadsheets at the email gateway/file server level.
• Ensure users know to avoid opening unexpected attachments and to report suspicious files immediately.
• Keep Office macro/security settings consistent with your normal policy (note: this CVE is specifically about a memory corruption/overflow triggered by crafted spreadsheet content; security settings may not fully prevent exploitation).

What to monitor

• Monitor endpoint alerts for Office spawning unusual processes shortly after Excel is opened.
• Review mail/file logs for repeated access to suspicious spreadsheet files and remove them from shared locations.

CISA due date

• Not provided in the findings (no KEV listing).

CVE-2026-81953 is rated HIGH with a CVSS score of 7.8. The weakness is CWE-121 (stack-based buffer overflow) affecting Microsoft Office Excel.

Mechanism (high level): opening a specially crafted spreadsheet can trigger memory corruption that allows an attacker to execute code on the victim machine. This requires user interaction (the user opening the file), and the vector is local to the affected system.

Exploitation status from the findings: not listed in CISA KEV and no public exploit code is on record. Press attention exists (Qualys roundup), but findings do not confirm active exploitation. EPSS is provided as a prediction (trend flat), but exploitation status is governed by the findings/KEV rather than prediction.

Fixed versions are available via Microsoft’s update guide, including Microsoft 365 Apps 16.0.20326.20138 and Microsoft Excel/Office builds such as 16.0.5569.1003, 16.0.10417.20207, 16.0.14334.20906, and 16.0.17932.20976.