Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2026-81394: Microsoft Excel may reveal system data to unauthorized users
CVE-2026-81394 · published 1 month ago
Summary
Microsoft Excel in several Office versions can unintentionally show internal system information to someone without permission. This could let an attacker learn details about the computer that should stay private. Apply the latest security updates from Microsoft to close the gap.
What to do
- Update microsoft microsoft excel 2016 to version 16.0.5569.1003 or later.
- Update microsoft microsoft office 2016 to version 16.0.5569.1003 or later.
- Update microsoft microsoft office 365 for mac to version 16.113.26091433 or later.
- Update microsoft microsoft office ltsc for mac 2021 to version 16.113.26091433 or later.
- Update microsoft microsoft office ltsc for mac 2024 to version 16.113.26091433 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | microsoft 365 apps for enterprise |
< 16.0.20326.20136 < 16.0.20326.20138 |
| microsoft | microsoft excel 2016 | < 16.0.5569.1003 |
| microsoft | microsoft office 2016 | < 16.0.5569.1003 |
| microsoft | microsoft office 2019 |
< 16.0.10417.20204 < 16.0.10417.20207 |
| microsoft | microsoft office 365 for mac |
- < 16.113.26091433 |
| microsoft | microsoft office ltsc 2021 |
< 16.0.14334.20896 < 16.0.14334.20906 |
| microsoft | microsoft office ltsc 2024 |
< 16.0.17932.20960 < 16.0.17932.20976 |
| microsoft | microsoft office ltsc for mac 2021 |
- < 16.113.26091433 |
| microsoft | microsoft office ltsc for mac 2024 |
- < 16.113.26091433 |
| microsoft | 365_apps |
All versions
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:* |
| microsoft | excel |
2016 cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x64:* |
| microsoft | microsoft_365 |
All versions
cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:* |
| microsoft | office_2016 |
All versions
cpe:2.3:a:microsoft:office_2016:-:*:*:*:-:*:x64:* |
| microsoft | office_2019 |
All versions
cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x64:* |
| microsoft | office_2021 |
All versions
cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:* |
| microsoft | office_2024 |
All versions
cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:* |
Original advisory text
Microsoft Excel Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81394 vendor-advisory patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-497Exposure of Sensitive System Information to an Unauthorized Control Sphere
Timeline
Published8 Sep 2026
Updated4 Nov 2026
First seen8 Sep 2026
Track software like this
Free during beta