Microsoft patches 114 Office flaws, four critical RCEs
Microsoft fixed 114 vulnerabilities across Office products, including four unauthenticated remote code execution flaws (CVSS 9.8) in Office, Outlook, and Skype.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 38 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
NCSC-NL relayed Microsoft's Patch Tuesday advisory covering 114 vulnerabilities across Microsoft Office and related components (Outlook, Skype). The four most severe issues — CVE-2026-78505 (Office), CVE-2026-78509 and CVE-2026-78510 (Outlook), and CVE-2026-66302 (Skype) — carry a CVSS score of 9.8 and could allow an attacker to execute arbitrary code without prior authentication if they can reach the vulnerable component. The remaining 110 vulnerabilities range from medium to critical severity and cover a very broad set of weakness classes, including buffer overflows (stack, heap, over-read), use-after-free, type confusion, deserialization of untrusted data, SSRF, XSS, SQL injection, and improper signature verification, among others.
Exploitation of most of these flaws requires the attacker to convince a victim to open a malicious file or follow a malicious link — consistent with typical Office document/attachment-based attack chains rather than fully zero-click network exploitation, though this should be verified per-CVE via the MSRC portal. No in-the-wild exploitation is claimed in this advisory. Defenders should prioritize the four 9.8-rated RCE issues (Office, Outlook, Skype) for expedited patching given their unauthenticated exploitation potential, and roll out the broader monthly Office update set through standard patch management processes. Full technical details, affected build numbers, and any workarounds are available via the Microsoft Security Response Center (MSRC) portal referenced in the advisory.
This is a routine vendor patch bulletin aggregated by NCSC-NL rather than a report of active exploitation or a novel attack campaign; the primary action for defenders is timely deployment of the November/December 2026 Office security updates across Windows and Office deployments.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0352.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs