CERT-FR Flags Mass Microsoft Office CVE Batch
CERT-FR advisory lists over 100 Microsoft Office vulnerabilities patched in the August 2026 update covering RCE, privilege escalation, and data exposure.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR published a routine security advisory summarizing a large batch of vulnerabilities affecting multiple Microsoft Office products, including Office 2016, 2019, LTSC 2021/2024, Access, Excel, Outlook, PowerPoint, Word, and Microsoft 365 Apps for Enterprise across Windows and Mac platforms. The advisory references over 100 individual CVEs disclosed by Microsoft's security bulletin dated 11 August 2026, with impacts ranging from remote code execution and privilege escalation to security bypass and confidentiality breaches.
No exploitation in the wild, proof-of-concept code, or specific threat actor activity is mentioned in the advisory. This is a standard vendor patch notification aggregated by the French national CERT, advising organizations to apply the vendor-supplied fixes referenced in the Microsoft Security Response Center update guide for each CVE. Given the scale of the update and reliance on Office as a common enterprise attack surface, organizations should prioritize patch deployment despite the absence of confirmed active exploitation.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1000
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs