Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-7262: Excel, Excel Viewer, and Compatibility Pack may run unauthorized commands

CVE-2016-7262 · published 9 years ago · actively exploited

Summary

Microsoft Excel, Excel Viewer, and the Office Compatibility Pack can be tricked into running commands that an attacker chooses. This could let an attacker take control of a computer or access data. Install the latest security updates from Microsoft as soon as they are available to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	excel	2007 2010 2013 2016
microsoft	excel_viewer	All versions `cpe:2.3:a:microsoft:excel_viewer:-:::::::*`
microsoft	office_compatibility_pack	All versions `cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3::::::`

Original advisory text

Microsoft Office Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands.

References

http://www.securitytracker.com/id/1037441 Broken Link Third Party Advisory VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-14... Patch Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-... US Government Resource
http://www.securityfocus.com/bid/94660 Broken Link Third Party Advisory VDB Entry

Fix within

Internet-facing 3 days

and check for signs of compromise

Internal 14 days

Known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.8 High

Exploitation

Known exploited

Listed in the CISA KEV catalogue - exploitation confirmed in the wild.

58% chance of attack within 30 days

Timeline

Published20 Dec 2016

Updated10 Oct 2026

First seen6 Mar 2026

Sources

CVE-2016-7262 · CISA KEV

CVE-2016-7262 · NVD

Track software like this

Free during beta