/
← Voltar ao feed
high

CERT-FR: Multiple Microsoft Office vulnerabilities allow remote code execution, data disclosure and security bypass

1 fonte(s) · 1 atualização(ões) · publicado 15/10/2026 21:00 · coletado há 14 horas

CERT-FR advisory CERTFR-2026-AVI-1331, published 16 October 2026, reports multiple vulnerabilities in Microsoft Office products. They allow an attacker to achieve remote arbitrary code execution, compromise data confidentiality and bypass the security policy. The advisory is based on Microsoft security bulletins dated 15 October 2026 covering CVE-2026-108426 to CVE-2026-108455 (29 CVEs listed; CVE-2026-108452 is not included). It gives no exploitation status, technical root cause, IOCs or attribution.

Detalhes técnicos

  • Impacts listed by CERT-FR: remote arbitrary code execution, data confidentiality compromise, security policy bypass.
  • Affected: Microsoft 365 Apps for Enterprise (32-bit and 64-bit); Office 365 for Mac before 16.114.26101123; Office LTSC 2021 (32/64-bit) before 16.0.14334.20974; Office LTSC 2024 (32/64-bit) before 16.0.17932.21056; Office LTSC for Mac 2021 and 2024 before 16.114.26101123; Office Online Server before 16.0.10417.20228.
  • The advisory does not map impacts to individual CVEs or give CVSS scores; these are in the Microsoft bulletins.

Remediação

  • Consult the Microsoft MSRC bulletins for each CVE and update Office products to the fixed builds (or later) listed above.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 15/10/2026 21:00 · coletado 21/10 12:01 primeiro registro

    CERT-FR: Multiple Microsoft Office vulnerabilities allow remote code execution, data disclosure and security bypass

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1331, published 16 October 2026, reports multiple vulnerabilities in Microsoft Office products. They allow an attacker to achieve remote arbitrary code execution, compromise data confidentiality and bypass the security policy. The advisory is based on Microsoft security bulletins dated 15 October 2026 covering CVE-2026-108426 to CVE-2026-108455 (29 CVEs listed; CVE-2026-108452 is not included). It gives no exploitation status, technical root cause, IOCs or attribution.

    Technical Details

    • Impacts listed by CERT-FR: remote arbitrary code execution, data confidentiality compromise, security policy bypass.
    • Affected: Microsoft 365 Apps for Enterprise (32-bit and 64-bit); Office 365 for Mac before 16.114.26101123; Office LTSC 2021 (32/64-bit) before 16.0.14334.20974; Office LTSC 2024 (32/64-bit) before 16.0.17932.21056; Office LTSC for Mac 2021 and 2024 before 16.114.26101123; Office Online Server before 16.0.10417.20228.
    • The advisory does not map impacts to individual CVEs or give CVSS scores; these are in the Microsoft bulletins.

    Remediation

    • Consult the Microsoft MSRC bulletins for each CVE and update Office products to the fixed builds (or later) listed above.