Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-55054: Microsoft Excel Leaks Sensitive Data Over Network

CVE-2026-55054 · published 3 months ago

Summary

An attacker can access sensitive data stored in Microsoft Excel files when they are shared over a network. This is a concern because it could allow unauthorized access to confidential information. To protect your data, ensure you're using the latest version of Microsoft Excel and follow recommended security best practices for sharing files.

What to do

Update microsoft microsoft 365 apps for enterprise to version https://aka.ms/OfficeSecurityReleases or later.
Update microsoft microsoft excel 2016 to version 16.0.5561.1001 or later.
Update microsoft microsoft office 2019 to version https://aka.ms/OfficeSecurityReleases or later.
Update microsoft microsoft office 365 for mac to version 16.111.26071215 or later.
Update microsoft microsoft office ltsc 2021 to version https://aka.ms/OfficeSecurityReleases or later.
Update microsoft microsoft office ltsc 2024 to version https://aka.ms/OfficeSecurityReleases or later.
Update microsoft microsoft office ltsc for mac 2021 to version 16.111.26071215 or later.
Update microsoft microsoft office ltsc for mac 2024 to version 16.111.26071215 or later.
Update microsoft office online server to version 16.0.10417.20175 or later.
Update microsoft office_2021 to version 16.111.26071215 or later.
Update microsoft office_2024 to version 16.111.26071215 or later.
Update microsoft office_online_server to version 16.0.10417.20175 or later.
Update microsoft office_365 to version 16.111.26071215 or later.

Affected software

Vendor	Product	Affected versions
microsoft	microsoft 365 apps for enterprise	< https://aka.ms/OfficeSecurityReleases 16.0.1
microsoft	microsoft excel 2016	< 16.0.5561.1001
microsoft	microsoft office 2019	< https://aka.ms/OfficeSecurityReleases 19.0.0
microsoft	microsoft office 365 for mac	< 16.111.26071215
microsoft	microsoft office ltsc 2021	< https://aka.ms/OfficeSecurityReleases 16.0.1
microsoft	microsoft office ltsc 2024	< https://aka.ms/OfficeSecurityReleases 16.0.0
microsoft	microsoft office ltsc for mac 2021	< 16.111.26071215
microsoft	microsoft office ltsc for mac 2024	< 16.111.26071215
microsoft	office online server	< 16.0.10417.20175
microsoft	office_2024	< 16.111.26071215 `cpe:2.3:a:microsoft:office_2024:-::::ltsc:-:x64:`
microsoft	365_apps	All versions `cpe:2.3:a:microsoft:365_apps:-::::enterprise::x64:*`
microsoft	excel	2016 `cpe:2.3:a:microsoft:excel:2016::::::x64:`
microsoft	office	2019 `cpe:2.3:a:microsoft:office:2019::::::x64:`
microsoft	office_2021	< 16.111.26071215 `cpe:2.3:a:microsoft:office_2021:::::ltsc:macos:-:*`
microsoft	office_online_server	< 16.0.10417.20175 `cpe:2.3:a:microsoft:office_online_server::::::::`
microsoft	office_365	< 16.111.26071215 `cpe:2.3:a:microsoft:office_365:::::-:::*`

Original advisory text

Microsoft Excel Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55054 vendor-advisory patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published14 Jul 2026

Updated3 Nov 2026

First seen14 Jul 2026

Sources

CVE-2026-55054 · NVD

CVE-2026-55054 · MITRE

Track software like this

Free during beta