Microsoft Office Patch Batch: 130+ CVEs
ANSSI advisory details over 130 Microsoft Office vulnerabilities enabling remote code execution, data disclosure, and security bypass; patch immediately.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
ANSSI (the French national cybersecurity agency) published a security advisory (CERTFR-2026-AVI-1145) consolidating a large batch of Microsoft Office vulnerabilities disclosed in Microsoft's September 2026 security bulletins. The affected product set is broad, spanning Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Office 2016, Office 2019, Office LTSC 2021/2024 (Windows and Mac), Office for Android, Office Online Server, and individual applications including Word, Excel, PowerPoint, Outlook, Access, and Publisher. Over 130 distinct CVEs are referenced, though ANSSI's summary does not provide individual technical descriptions for each — it groups them under three risk categories: remote code execution, confidentiality breach (data disclosure), and security policy bypass.
No evidence of active in-the-wild exploitation is mentioned in this bulletin; it is a standard vendor-patch consolidation advisory. Given the sheer volume of RCE-capable flaws across nearly every supported Office version and platform, organizations should prioritize deployment of the referenced Microsoft updates across all affected product lines. Defenders should treat document-based attack surfaces (macro execution, OLE embedding, file parsing) as the likely vector class for these flaws and ensure patch management processes cover both mainstream Office channels and legacy/LTSC editions, which are frequently overlooked in update cycles.
As is typical for ANSSI Office bulletins, remediation guidance is simply to apply the vendor patches referenced in the Microsoft Security Response Center (MSRC) update guide entries for each CVE. No IOCs, threat actor attribution, or malware association is provided in the source material, consistent with a routine vulnerability disclosure rather than an incident report.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1145
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs