Multiple critical vulnerabilities in Microsoft Office including actively exploited remote code execution CVE-2026-124194
Multiple security vulnerabilities have been identified in Microsoft Office products, including Microsoft 365 Apps, Office 365 for Mac, Office LTSC 2021 and 2024 editions, Office Online Server, and Microsoft.DotNet.Web.ProjectTemplates across various versions. These vulnerabilities enable attackers to perform remote code execution, privilege escalation, and data confidentiality breaches. Notably, CVE-2026-124194 is confirmed as actively exploited in the wild. Users are strongly advised to promptly apply the official security updates provided by Microsoft, covering a wide range of CVEs disclosed on November 10, 2026. The vulnerabilities affect both 32-bit and 64-bit systems and multiple Office versions, including Mac editions, highlighting a broad attack surface.
Entenda a falha
A vulnerabilidade
Microsoft's November 10, 2026 updates fix a large batch of CVEs in Microsoft Office, and the CERT-FR advisory lists about 100 of them. CVE-2026-124194 is the most severe: Microsoft says it is actively exploited. According to CERT-FR, the batch allows remote code execution, privilege escalation, security policy bypass and loss of data confidentiality. The articles give no per-CVE detail on attacker requirements. Affected products are Microsoft 365 Apps for Enterprise (32 and 64-bit), Office LTSC 2021 before 16.0.14334.21048, Office LTSC 2024 before 16.0.17932.21140, Office 365 for Mac and LTSC for Mac 2021/2024 before 16.115.26110837, Office Online Server before 16.0.10417.20236, and Microsoft.DotNet.Web.ProjectTemplates before 8.0.34, 9.0.23, 10.0.15 and 11.0.0 (for the 8.0, 9.0, 10.0 and 11.0 lines respectively).
Como foi descoberta
The articles do not say who found these flaws or how. Microsoft published its security bulletins on November 10, 2026, and CERT-FR republished the list in an advisory on November 12, 2026. Per CERT-FR, Microsoft itself states that CVE-2026-124194 is being exploited in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 13:35.
Linha do tempo
-
Multiple critical vulnerabilities in Microsoft Office including actively exploited remote code execution CVE-2026-124194
ler a análise desta fonte ocultar
Multiple security vulnerabilities have been identified in Microsoft Office products, including Microsoft 365 Apps, Office 365 for Mac, Office LTSC 2021 and 2024 editions, Office Online Server, and Microsoft.DotNet.Web.ProjectTemplates across various versions. These vulnerabilities enable attackers to perform remote code execution, privilege escalation, and data confidentiality breaches. Notably, CVE-2026-124194 is confirmed as actively exploited in the wild. Users are strongly advised to promptly apply the official security updates provided by Microsoft, covering a wide range of CVEs disclosed on November 10, 2026. The vulnerabilities affect both 32-bit and 64-bit systems and multiple Office versions, including Mac editions, highlighting a broad attack surface.