Microsoft Office Patches Dozens of Flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR advisory lists 29 Microsoft Office vulnerabilities allowing remote code execution, data exposure, and security bypass; patches available.
CERT-FR issued an advisory covering 29 vulnerabilities (CVE-2026-108426 through CVE-2026-108455, excluding 108452) affecting multiple Microsoft Office products, including Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Office 365 for Mac, Office LTSC 2021 and 2024 (Windows and Mac editions), and Office Online Server. The flaws collectively enable remote code execution, unauthorized disclosure of confidential data, and bypass of security policy controls.
No evidence of active exploitation is mentioned in the advisory. CERT-FR directs administrators to Microsoft's security update guide for each CVE to obtain patches. Organizations running the affected Office versions should prioritize applying the vendor-supplied updates, particularly given the remote code execution risk across widely deployed enterprise productivity software.
As this is a vendor patch bulletin relayed by a national CERT, defenders should treat it as a standard patch management action: inventory affected Office/Office LTSC/Office Online Server deployments, apply the listed fixed versions (e.g., Office LTSC 2021 ≥16.0.14334.20974, Office LTSC 2024 ≥16.0.17932.21056, Office for Mac ≥16.114.26101123, Office Online Server ≥16.0.10417.20228), and monitor for any subsequent in-the-wild exploitation reporting tied to these CVE identifiers.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1331
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs