As cited
Copy frozen at (site build).
vulnerabilities
NCSC-2026-0422 Vulnerabilities Fixed in Microsoft Office
Microsoft released patches for more than 150 vulnerabilities spanning Office applications (Word, Excel, Access, Outlook, Visio, SharePoint, PowerPoint), Windows Shell, Azure Key Vault, and related components. The flaws enable remote code execution, privilege escalation, information disclosure, and denial of service, with most requiring social engineering to trigger through malicious file opens or links. One vulnerability (CVE-2026-96951) in Windows Shell is known to be exploited in limited, targeted attacks.
Why it matters: Organizations using Microsoft Office, SharePoint, or Azure services must patch promptly, as multiple high-severity vulnerabilities (CVSS 8.8 to 9.8) allow code execution with minimal user interaction; prioritize CVE-2026-70300, CVE-2026-70242, CVE-2026-70291, CVE-2026-88156, CVE-2026-97016, CVE-2026-97749, CVE-2026-88178 in Word, Outlook, and PowerPoint, plus CVE-2026-96951 (actively exploited) in Windows Shell.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
NCSC-2026-0422 Vulnerabilities Fixed in Microsoft Office
Microsoft released patches for more than 150 vulnerabilities spanning Office applications (Word, Excel, Access, Outlook, Visio, SharePoint, PowerPoint), Windows Shell, Azure Key Vault, and related components. The flaws enable remote code execution, privilege escalation, information disclosure, and denial of service, with most requiring social engineering to trigger through malicious file opens or links. One vulnerability (CVE-2026-96951) in Windows Shell is known to be exploited in limited, targeted attacks.
Why it matters: Organizations using Microsoft Office, SharePoint, or Azure services must patch promptly, as multiple high-severity vulnerabilities (CVSS 8.8 to 9.8) allow code execution with minimal user interaction; prioritize CVE-2026-70300, CVE-2026-70242, CVE-2026-70291, CVE-2026-88156, CVE-2026-97016, CVE-2026-97749, CVE-2026-88178 in Word, Outlook, and PowerPoint, plus CVE-2026-96951 (actively exploited) in Windows Shell.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
NCSC-2026-0422 Vulnerabilities Fixed in Microsoft Office
Microsoft released patches for more than 150 vulnerabilities spanning Office applications (Word, Excel, Access, Outlook, Visio, SharePoint, PowerPoint), Windows Shell, Azure Key Vault, and related components. The flaws enable remote code execution, privilege escalation, information disclosure, and denial of service, with most requiring social engineering to trigger through malicious file opens or links. One vulnerability (CVE-2026-96951) in Windows Shell is known to be exploited in limited, targeted attacks.
Why it matters: Organizations using Microsoft Office, SharePoint, or Azure services must patch promptly, as multiple high-severity vulnerabilities (CVSS 8.8 to 9.8) allow code execution with minimal user interaction; prioritize CVE-2026-70300, CVE-2026-70242, CVE-2026-70291, CVE-2026-88156, CVE-2026-97016, CVE-2026-97749, CVE-2026-88178 in Word, Outlook, and PowerPoint, plus CVE-2026-96951 (actively exploited) in Windows Shell.
- Source published
- First seen by Cybersecurity Tracker