Loading story…
Microsoft’s March Patch Tuesday release fixed roughly 80+ vulnerabilities, including a critical Microsoft Excel information disclosure flaw tracked as CVE-2026-26144. The issue is described as a cross-site scripting (XSS) condition that can be exploited in a zero-click scenario to trigger Copilot Agent mode to exfiltrate data via unintended network egress, creating a path for silent theft of sensitive information commonly stored in spreadsheets (e.g., financials, IP, operational records). Reporting noted the exploit requires network access but does not require user interaction or privilege escalation.
Security guidance emphasized prioritizing patch deployment for CVE-2026-26144 and, where patching must be delayed, reducing exposure by constraining outbound connectivity and watching for anomalous Excel-initiated traffic. Suggested mitigations included restricting outbound network traffic from Office applications, monitoring unusual network requests generated by Excel processes, and disabling or limiting Copilot Agent until the fix is applied. Separate high-priority fixes highlighted in the same Patch Tuesday cycle included SQL Server elevation of privilege (CVE-2026-21262) and a .NET denial-of-service issue (CVE-2026-26127).
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-10, Expel said attackers were actively exploiting an old, unpatched vulnerability in the abandoned Kaswara Modern WPBakery Page Builder WordPress plugin. According to the report, the flaw was being used to upload and run malicious PHP, compromise sites, and deploy XMRig cryptomining malware.
On 2026-03-10, security coverage and analysis emphasized that CVE-2026-26144 in Microsoft Excel could abuse Copilot Agent mode to exfiltrate sensitive data via unintended network egress without user interaction. Reports noted the issue was especially concerning in enterprise environments and suggested mitigations such as restricting Office outbound traffic and limiting Copilot Agent use until patched.
On 2026-03-10, Microsoft released its March Patch Tuesday updates, addressing dozens of vulnerabilities across products including Excel, .NET, SQL Server, and Office. The release included the zero-click Excel information disclosure flaw CVE-2026-26144 and other publicly known issues not reported as actively exploited at disclosure time.
Expel noted that the same Kaswara plugin vulnerability had previously been tied to large botnet campaigns in 2021. Those campaigns reportedly used NDSW/BNTS malware to inject malicious redirects into thousands of WordPress sites worldwide.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
expel.com
Open sourcego.theregister.com
Open sourceconnect.tenable.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that vulnerabilities in Microsoft 365 Copilot and Consumer Copilot allowed attackers to turn prompt injection into data exfiltration, memory poisoning, and persistent compromise. Microsoft assigned `CVE-2026-24299` to the main issue set and rolled out fixes across late 2025 and early 2026, while a related Microsoft Excel flaw, `CVE-2026-26144`, showed how a conventional application bug could be chained with Copilot Agent mode to silently extract spreadsheet data. In the Copilot attacks, malicious content abused HTML preview rendering to leak sensitive information through external requests, first with CSS background images and later with `@font-face`, and researchers said users could be coerced into triggering the preview during normal interaction, creating a near zero-click exfiltration path. The research also showed that Copilot’s memory features could be poisoned to add or delete stored facts and implant persistent instructions that altered future sessions, enabling a backdoor dubbed **SpAIware** that continued leaking secrets over time. Similar issues were described in consumer Copilot, including durable-memory manipulation and browser-navigation exfiltration through Edge-integrated tooling. The findings underscore a broader security shift: AI assistants can collapse trust boundaries inside host applications, raising the impact of older flaws and forcing defenders to reassess assistant permissions, restrict outbound network access from AI-enabled apps, and separately monitor AI-initiated network activity.
Jun 29, 2026
Microsoft published a long series of security advisories for **remote code execution** vulnerabilities affecting core Office components, with the largest concentration in **Excel** and **Word**. The disclosures include Excel flaws such as `CVE-2024-49026`, `CVE-2024-49069`, `CVE-2025-21362`, `CVE-2025-21381`, `CVE-2025-21387`, `CVE-2025-24082`, `CVE-2025-62553`, `CVE-2026-26107`, `CVE-2026-26109`, `CVE-2026-26112`, and `CVE-2026-40359`, alongside Word issues including `CVE-2025-24077`, `CVE-2025-24078`, `CVE-2025-47170`, `CVE-2025-49700`, `CVE-2025-59222`, `CVE-2026-23657`, and `CVE-2026-33095`. Microsoft also listed related RCE bugs in **Microsoft Office** (`CVE-2025-21392`), **PowerPoint** (`CVE-2025-54908`), **Inbox COM Objects (Global Memory)** (`CVE-2025-58730`), and the **Visual Studio Code Python Extension** (`CVE-2025-49714`). One of the few entries with technical detail, **`CVE-2026-40359`**, describes an **Important** Excel use-after-free flaw (`CWE-416`) with a **CVSS 3.1 score of 7.8** that can let an attacker execute code if a user opens a malicious Office file. Microsoft said the bug was **not publicly disclosed**, **not exploited in the wild**, and **less likely** to be exploited at the time of publication, adding that the **Preview Pane is not an attack vector** and that a fix is available. Taken together, the advisories show Microsoft continuing to address document-driven code execution risks across Office products, where successful exploitation generally depends on **user interaction with crafted files** rather than direct network exposure.
Jun 29, 2026
Microsoft disclosed **`CVE-2026-62870`**, a high-severity remote code execution vulnerability in **Microsoft Excel** caused by a use-after-free flaw. The bug carries a **CVSS v3.1 score of 8.8** and affects **Microsoft 365 Apps for Enterprise**, **Excel 2016**, **Office 2019**, **Office LTSC 2021**, and **Office LTSC 2024** on both **32-bit** and **x64-based** systems. According to the advisory, an unauthenticated attacker could exploit the flaw over a network by delivering a specially crafted Excel file and executing code in the context of the current user. Microsoft released security updates addressing the issue, and reporting indicates exploitation requires **user interaction** to open the malicious file. Successful compromise could let attackers install malware, steal data, and pivot further into enterprise environments depending on the victim's privileges. At the time of publication, there was **no public exploit** and **no confirmed active exploitation**, and the vulnerability had **not** been added to **CISA's Known Exploited Vulnerabilities catalog**.
Aug 4, 2026