/
← Voltar ao feed
critical

CERT-FR: Multiple Microsoft Office vulnerabilities patched, CVE-2026-96951 actively exploited

1 fonte(s) · 1 atualização(ões) · publicado 13/10/2026 21:00 · coletado há 1 dia

CERT-FR advisory CERTFR-2026-AVI-1312 covers a large set of vulnerabilities in Microsoft Office, fixed in Microsoft's 13 October 2026 security updates. Exploitation can lead to remote arbitrary code execution, privilege escalation, security policy bypass and loss of data confidentiality. Microsoft states that CVE-2026-96951 is being actively exploited. The affected range is broad: Microsoft 365 Apps, Office LTSC 2021 and 2024 (Windows and Mac), Office for Android, Office Online Server and Outlook.com.

Detalhes técnicos

  • The advisory lists more than 100 CVEs, each with its own MSRC bulletin dated 13 October 2026. The article text is truncated, so the list may be incomplete.
  • Impact categories: remote code execution, privilege escalation, security policy bypass and confidentiality breach. The article does not map impacts to individual CVEs.
  • Affected versions named in the advisory:
    • Office LTSC 2021 builds prior to 16.0.14334.20878 / 16.0.14334.20974 (32-bit and 64-bit).
    • Office LTSC 2024 builds prior to 16.0.17932.20934 / 16.0.17932.21056 (32-bit and 64-bit).
    • Office for Android prior to 16.0.20430.20000.
    • Office Online Server prior to 16.0.10417.20228.
    • Outlook.com prior to 20260925.100.
    • Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Office 365 for Mac, and Office LTSC for Mac 2021 and 2024. No fixed build is given for these.
  • The article gives no details on the exploitation of CVE-2026-96951, no IOCs and no attribution.

Remediação

  • Apply the patches referenced in the Microsoft security bulletins (MSRC Update Guide) for the 13 October 2026 release.
  • Prioritise remediation of CVE-2026-96951, which is actively exploited.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 13/10/2026 21:00 · coletado 20/10 16:31 primeiro registro

    CERT-FR: Multiple Microsoft Office vulnerabilities patched, CVE-2026-96951 actively exploited

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1312 covers a large set of vulnerabilities in Microsoft Office, fixed in Microsoft's 13 October 2026 security updates. Exploitation can lead to remote arbitrary code execution, privilege escalation, security policy bypass and loss of data confidentiality. Microsoft states that CVE-2026-96951 is being actively exploited. The affected range is broad: Microsoft 365 Apps, Office LTSC 2021 and 2024 (Windows and Mac), Office for Android, Office Online Server and Outlook.com.

    Technical Details

    • The advisory lists more than 100 CVEs, each with its own MSRC bulletin dated 13 October 2026. The article text is truncated, so the list may be incomplete.
    • Impact categories: remote code execution, privilege escalation, security policy bypass and confidentiality breach. The article does not map impacts to individual CVEs.
    • Affected versions named in the advisory:
      • Office LTSC 2021 builds prior to 16.0.14334.20878 / 16.0.14334.20974 (32-bit and 64-bit).
      • Office LTSC 2024 builds prior to 16.0.17932.20934 / 16.0.17932.21056 (32-bit and 64-bit).
      • Office for Android prior to 16.0.20430.20000.
      • Office Online Server prior to 16.0.10417.20228.
      • Outlook.com prior to 20260925.100.
      • Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Office 365 for Mac, and Office LTSC for Mac 2021 and 2024. No fixed build is given for these.
    • The article gives no details on the exploitation of CVE-2026-96951, no IOCs and no attribution.

    Remediation

    • Apply the patches referenced in the Microsoft security bulletins (MSRC Update Guide) for the 13 October 2026 release.
    • Prioritise remediation of CVE-2026-96951, which is actively exploited.