# Microsoft Office Patches Dozens of Flaws

Published: 2026-10-16 · Severity: elevated
Canonical: https://vorant.io/reports/ebe05098-c10d-5560-8e38-08934f8c968d/microsoft-office-patches-dozens-of-flaws

> CERT-FR advisory lists 29 Microsoft Office vulnerabilities allowing remote code execution, data exposure, and security bypass; patches available.

CERT-FR issued an advisory covering 29 vulnerabilities (CVE-2026-108426 through CVE-2026-108455, excluding 108452) affecting multiple Microsoft Office products, including Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Office 365 for Mac, Office LTSC 2021 and 2024 (Windows and Mac editions), and Office Online Server. The flaws collectively enable remote code execution, unauthorized disclosure of confidential data, and bypass of security policy controls.

No evidence of active exploitation is mentioned in the advisory. CERT-FR directs administrators to Microsoft's security update guide for each CVE to obtain patches. Organizations running the affected Office versions should prioritize applying the vendor-supplied updates, particularly given the remote code execution risk across widely deployed enterprise productivity software.

As this is a vendor patch bulletin relayed by a national CERT, defenders should treat it as a standard patch management action: inventory affected Office/Office LTSC/Office Online Server deployments, apply the listed fixed versions (e.g., Office LTSC 2021 ≥16.0.14334.20974, Office LTSC 2024 ≥16.0.17932.21056, Office for Mac ≥16.114.26101123, Office Online Server ≥16.0.10417.20228), and monitor for any subsequent in-the-wild exploitation reporting tied to these CVE identifiers.

## Mentioned in this report

- Vulnerabilities: CVE-2026-108426, CVE-2026-108427, CVE-2026-108428, CVE-2026-108429, CVE-2026-108430, CVE-2026-108431, CVE-2026-108432, CVE-2026-108433, CVE-2026-108434, CVE-2026-108435, CVE-2026-108436, CVE-2026-108437, CVE-2026-108438, CVE-2026-108439, CVE-2026-108440, CVE-2026-108441, CVE-2026-108442, CVE-2026-108443, CVE-2026-108444, CVE-2026-108445, CVE-2026-108446, CVE-2026-108447, CVE-2026-108448, CVE-2026-108449, CVE-2026-108450, CVE-2026-108451, CVE-2026-108453, CVE-2026-108454, CVE-2026-108455

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1331

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ebe05098-c10d-5560-8e38-08934f8c968d/microsoft-office-patches-dozens-of-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup