CVE-2026-81959

Microsoft Excel is like a spreadsheet “engine” that opens and processes files. This vulnerability is a flaw in that engine that can be triggered by a specially made Excel file, which can cause the computer to run attacker code when the file is opened.

This matters if your business uses Microsoft Excel or Microsoft Office products such as Microsoft 365 Apps, Microsoft Excel, or Office 2016/2019/2021/2024 (including Mac variants). The risk is tied to opening a malicious Excel file—so it’s most relevant on devices where people receive or download Office files, and only if an attacker can reach users with a crafted file (it’s not about someone being “authenticated” inside your network).

Treat this as urgent because it affects a common workplace application and the impact is full code execution on the user’s machine. Even though there’s no listing in CISA’s KEV feed and no public exploit code is recorded, the vulnerability has clear potential for real-world harm when users open malicious attachments, and Microsoft has already provided fixed versions.

Confirm exposure

1. On each affected device, identify the exact Office/Excel product and its build number (e.g., via Office “About” screen).
2. Check whether the device is running a product family listed in the affected set: Microsoft 365 Apps, Microsoft Excel, Microsoft 365, Office 2016/2019/2021/2024, and the relevant Mac Office variants.
3. Determine which fixed build you should reach based on your Office branch:
   • Microsoft 365 Apps: fixed in 16.0.20326.20140
   • Microsoft Excel: fixed in 16.0.5569.1003
   • Microsoft Office: fixed in 16.0.5569.1003
   • Microsoft Office: fixed in 16.0.10417.20207
   • Microsoft Office: fixed in 16.0.14334.20906
   • Microsoft Office: fixed in 16.0.17932.20976

Patch / remediation

4. Apply Microsoft updates until your build matches one of the fixed versions above for your installed product/branch.
5. If your environment uses update rings (delayed deployment), temporarily move Excel/Office clients into the next available ring so you can get them to a fixed build faster.

Temporary containment (if patching is delayed)

6. Tighten email and download handling: limit user ability to open files from untrusted sources and ensure suspicious attachments are quarantined before users can open them.
7. Remove or quarantine any Excel files users may have opened from unknown senders after the timeframe you started noticing unusual emails.

What to monitor after updating

8. Watch for unusual endpoints behavior (new processes launched soon after Excel opens, unexpected outbound connections) and check endpoint security alerts tied to Excel/Office activity.

Reference timelines

• No CISA KEV due date is provided for this CVE (not listed in KEV based on the findings). Use Microsoft’s published update guidance as the primary timeline for remediation.

Severity is high due to the likelihood of attacker-controlled code execution in a widely deployed application. The weakness is categorized as CWE-122 (heap memory corruption) and CWE-190 (integer/logic-related issue type often associated with memory safety problems); the impact described is consistent with a memory corruption that can be turned into local code execution via a crafted Excel document.

Attack vector (from the premise of the Excel RCE description and the product): an attacker delivers a malicious Excel file to a target user; when the user opens it, the vulnerability can be triggered. According to the provided findings, no CISA KEV entry exists and no public exploit code is on record; press attention has been noted (Qualys roundup), but exploit maturity is not confirmed by the findings. The predicted likelihood (EPSS) is reported as 0.4% with a flat trend; this is a prediction only and should not be treated as evidence of active exploitation for this specific CVE.