Multiple Microsoft Office vulnerabilities enable remote code execution
ANSSI advisory covers 72 CVEs across Microsoft Office 2016, 2019, LTSC editions, and cloud apps allowing remote code execution, privilege escalation, and data theft.
ANSSI has published a security advisory covering a large batch of vulnerabilities affecting Microsoft Office products across multiple versions and platforms. The vulnerabilities span Microsoft Office 2016 (32/64-bit), Office 2019, Office LTSC 2021 and 2024 editions, Office 365 for Mac, Microsoft 365 Apps for Enterprise, Microsoft 365 Copilot for mobile platforms, and Office Online Server. The advisory indicates three primary impact categories: remote code execution, privilege escalation, and confidentiality breaches. Affected versions include Office 2016 prior to 16.0.5561.1000/1001 across Word, Excel, and PowerPoint; Office 2019 in all editions; LTSC versions for both 2021 and 2024; Office 365 for Mac prior to 16.111.26071215; Office for Android prior to 16.0.20228.20042; and Microsoft 365 Copilot for iOS prior to 2.111.4. Defenders should prioritize patching these products across their estate, with particular attention to widely-deployed Office 2016 and cloud-connected Microsoft 365 deployments.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0868
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free