Microsoft Patches 180+ Office Flaws Including SharePoint RCE

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

NCSC-NL advisory covers 180+ Microsoft Office vulnerabilities, including two critical SharePoint flaws (CVSS 9.0 and 9.9) with no confirmed active exploitation.

Sourceadvisories.ncsc.nl — open the original

NCSC-NL has published a consolidated advisory for November 2026 covering a very large batch of vulnerabilities patched by Microsoft across the Office product family, including Word, Excel, PowerPoint, Outlook, Access, Visio, OneNote, SharePoint, and Teams (desktop and Android). The bulk of the flaws are memory-corruption issues (stack/heap buffer overflows, use-after-free, double-free, out-of-bounds read/write, off-by-one and numeric conversion errors) that lead to remote code execution when a user is convinced to open a malicious file or follow a malicious link. Other classes include deserialization of untrusted data, SSRF, authorization bypass, and improper authorization, mostly affecting SharePoint and resulting in privilege escalation or spoofing/impersonation.

The two most severe issues are both in Microsoft SharePoint: CVE-2026-109454 (CVSS 9.0), a cross-site scripting flaw that an authenticated attacker can exploit over the network to perform spoofing, and CVE-2026-120002 (CVSS 9.9), caused by insufficient authorization checks that let an authenticated attacker escalate privileges remotely. The advisory also lists dozens of CVSS 8.8 remote-code-execution bugs spread across Word, Excel, PowerPoint, Outlook, Access, Visio and OneNote, most requiring a victim to open a crafted document or link (no indication of zero-click exploitation). SharePoint also carries a cluster of CVSS 7.3–8.8 spoofing/impersonation and elevation-of-privilege bugs.

No in-the-wild exploitation is reported by NCSC-NL or referenced MSRC entries at time of publication; this is a routine patch-cycle advisory. Defenders should prioritize patching SharePoint servers (especially CVE-2026-109454 and CVE-2026-120002) and roll out the broader Office update set via standard patch management, since the volume of RCE-capable bugs across commonly used client applications (Word, Excel, PowerPoint, Outlook) makes phishing-delivered malicious documents the most likely exploitation vector going forward.

title: Office Application Spawning Script Interpreter or LOLBin
id: 645ff05b-ce6f-53b3-8ced-8fef5bbc48db
status: experimental
description: Detects Office client applications spawning command interpreters, script
  hosts or common proxy-execution/download binaries. This is the typical child-process
  pattern after a phishing-delivered document exploits a memory-corruption flaw or
  runs a macro. Generalises on the parent/child relation, not on any specific CVE.
tags:
- attack.execution
- attack.t1204.002
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    - \MSACCESS.EXE
    - \VISIO.EXE
    - \ONENOTE.EXE
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \regsvr32.exe
    - \rundll32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Excel or Access macros/add-ins in line-of-business workflows that call cmd.exe or
  PowerShell
- Outlook add-ins or helper tools that launch rundll32.exe for file handling
level: medium
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0474.html

title: SharePoint IIS Worker Process Spawning Shell
id: 1c6adb8a-f547-5bd2-9bc8-30bb6e439f56
status: experimental
description: Detects the IIS worker process serving a SharePoint application pool
  spawning a command interpreter. SharePoint server flaws (deserialization of untrusted
  data, authorization bypass, RCE) are commonly exploited to run commands from w3wp.exe.
  Generalises on the parent/child pattern, not on specific CVEs.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    ParentCommandLine|contains: SharePoint
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Custom SharePoint farm solutions or timer-style web parts that intentionally shell
  out to cmd.exe
level: high
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0474.html

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0474.html

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.