Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-97754: Microsoft Excel can let attackers run code remotely

CVE-2026-97754 · published 22 days ago

Summary

Certain versions of Microsoft Excel for Windows and Mac have a coding mistake that could let an attacker run their own programs on your computer over the network. This could allow the attacker to take control of the system or steal data. Install the latest security updates from Microsoft as soon as possible to protect your machines.

What to do

Update microsoft microsoft office ltsc 2021 to version 16.0.14334.20974 or later.
Update microsoft microsoft office ltsc 2024 to version 16.0.17932.21056 or later.
Update microsoft office online server to version 16.0.10417.20228 or later.
Update microsoft office_online_server to version 16.0.10417.20228 or later.

Affected software

Vendor	Product	Affected versions
microsoft	microsoft 365 apps for enterprise	16.0.1
microsoft	microsoft office 365 for mac	< publication < 16.114.26101123
microsoft	microsoft office ltsc 2021	< 16.0.14334.20974
microsoft	microsoft office ltsc 2024	< 16.0.17932.21056
microsoft	microsoft office ltsc for mac 2021	< publication < 16.114.26101123
microsoft	microsoft office ltsc for mac 2024	< publication < 16.114.26101123
microsoft	office online server	< 16.0.10417.20228
microsoft	365_apps	All versions `cpe:2.3:a:microsoft:365_apps:-::::enterprise::x64:*`
microsoft	microsoft_365	All versions `cpe:2.3:a:microsoft:microsoft_365:-:::::macos::`
microsoft	office_2021	All versions `cpe:2.3:a:microsoft:office_2021:-::::ltsc:-:x64:`
microsoft	office_2024	All versions `cpe:2.3:a:microsoft:office_2024:-::::ltsc:-:x64:`
microsoft	office_online_server	< 16.0.10417.20228 `cpe:2.3:a:microsoft:office_online_server::::::::`

Original advisory text

Microsoft Office Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97754 vendor-advisory patch

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

Timeline

Published13 Oct 2026

Updated4 Nov 2026

First seen13 Oct 2026

Sources

CVE-2026-97754 · NVD

CVE-2026-97754 · MITRE

Track software like this

Free during beta