Microsoft patches exploited Office flaw

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Microsoft fixed numerous Office vulnerabilities, including one actively exploited in limited, targeted attacks requiring social engineering.

NCSC-NL republished a Dutch-language advisory summarizing a Microsoft patch release covering a large number of vulnerabilities across Office products including Word, Excel, Access, Outlook, Visio, SharePoint, PowerPoint, OneNote, and subcomponents such as Windows Shell, Azure Key Vault, Azure DevOps, Skype for Business/Lync, and Click-to-Run. The vulnerability classes span remote code execution, privilege escalation, denial of service, and information disclosure, stemming from issues such as path traversal, command injection, buffer overflows (stack/heap), use-after-free, deserialization of untrusted data, SSRF, improper authorization, and cryptographic signature verification failures.

Successful exploitation generally requires the victim to be tricked into opening a malicious file or following a malicious link, indicating these are primarily client-side attack vectors reliant on social engineering rather than remote, unauthenticated exploitation. Microsoft has confirmed that CVE-2026-96951 has been exploited in a limited and targeted manner in the wild; no public proof-of-concept or exploit code is currently known for this CVE, and exploitation still requires social engineering.

Defenders should prioritize deploying Microsoft's security updates across all affected Office products and subcomponents as soon as possible, with particular urgency for systems where CVE-2026-96951 could be leveraged. Organizations should also reinforce user awareness around opening untrusted email attachments and links, apply attack surface reduction rules where applicable (e.g., blocking Office child processes, disabling macros from untrusted sources), and monitor for anomalous Office process behavior consistent with exploitation of memory-corruption or deserialization flaws.

title: Office Application Spawning Script Interpreter or LOLBin
id: ad557e74-63ad-5b3b-a554-3d32dde82f3f
status: experimental
description: Detects Office applications (Word, Excel, PowerPoint, Outlook, Access,
  Visio, OneNote) spawning command interpreters, script hosts or common living-off-the-land
  binaries. This is consistent with exploitation of Office memory-corruption/deserialization
  flaws or malicious documents reached via phishing.
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0422.html
tags:
- attack.execution
- attack.t1203
- attack.initial-access
- attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    - \MSACCESS.EXE
    - \VISIO.EXE
    - \ONENOTE.EXE
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msbuild.exe
  condition: selection_parent and selection_child
falsepositives:
- Office macros or add-ins in business workflows that legitimately launch cmd or PowerShell
- Document management or reporting tools that automate Office and call scripts
level: high
author: Vorant

title: Office Application Dropping Executable or Script in User-Writable Path
id: 3f91586e-d1aa-57d6-b508-2535740684df
status: experimental
description: Detects Office processes creating executable, DLL or script files in
  user-writable locations such as Temp, AppData, Public or Downloads. This indicates
  payload staging after opening a malicious attachment or exploiting a client-side
  Office flaw.
tags:
- attack.initial-access
- attack.t1566.001
- attack.execution
- attack.t1203
logsource:
  category: file_event
  product: windows
detection:
  selection_proc:
    Image|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    - \MSACCESS.EXE
    - \VISIO.EXE
  selection_path:
    TargetFilename|contains:
    - \AppData\
    - \Temp\
    - \Users\Public\
    - \Downloads\
  selection_ext:
    TargetFilename|endswith:
    - .exe
    - .dll
    - .scr
    - .ps1
    - .vbs
    - .js
    - .hta
    - .bat
    - .cmd
  condition: selection_proc and selection_path and selection_ext
falsepositives:
- Office add-in installers or updaters writing DLLs to AppData
- Users saving script files from email attachments intentionally
level: medium
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0422.html

title: Process Executed From Outlook Attachment Cache or Office Temp Content Path
id: 1c295b05-2847-5f09-a383-04ff9465c398
status: experimental
description: Detects execution of binaries or scripts from the Outlook secure temp
  folder or INetCache Content.Outlook, which means a user ran an attachment directly
  from a phishing email.
tags:
- attack.initial-access
- attack.t1566.001
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
    - \Content.Outlook\
    - \Microsoft\Windows\INetCache\Content.Outlook\
    - \AppData\Local\Temp\Temp1_
  selection_ext:
    Image|endswith:
    - .exe
    - .scr
    - .com
  selection_parent:
    ParentImage|endswith:
    - \OUTLOOK.EXE
    - \explorer.exe
  condition: (selection_path and selection_ext) or (selection_parent and selection_path)
falsepositives:
- Users running signed installer attachments from email
- Portable utilities extracted from emailed zip archives
level: medium
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0422.html

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0422.html