endpoint-software-vulnerabilitywidely-deployed-product-advisory

Critical Microsoft Excel Information Disclosure Vulnerability (CVE-2026-26144)

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Mar 11, 2026

Microsoft published guidance for CVE-2026-26144, a Critical Microsoft Excel information disclosure vulnerability tracked in the Microsoft Security Update Guide. Microsoft maps the issue to CWE-79 (improper neutralization of input during web page generation / XSS) and provides CVSS v3.1 scoring indicating network-reachable exploitation conditions with high confidentiality impact (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

The advisory is available via MSRC’s Update Guide endpoints (including RSS, PowerShell, API, and CSAF links) to support patch/vulnerability management workflows. No additional incident context, exploitation details, or third-party reporting is included in the provided material beyond the MSRC advisory metadata and scoring.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

1 event · Mar 10, 2026

Mar 10, 20268mo ago
Microsoft discloses CVE-2026-26144 in Excel Security Update Guide
Microsoft published Security Update Guide entries for CVE-2026-26144, identifying it as a Microsoft Excel information disclosure vulnerability. No additional technical synopsis was provided in the referenced advisories.

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Msrc Security AdvisoriesAdvisories · Mar 10, 2026

CVE-2026-26144 - Security Update Guide - Microsoft - Microsoft Excel Information Disclosure VulnerabilityOpen source ↗

Msrc MicrosoftAdvisories · Mar 10, 2026

CVE-2026-26144 - Security Update Guide - Microsoft - Microsoft Excel Information Disclosure VulnerabilityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Critical Microsoft Excel Information Disclosure Vulnerability (CVE-2026-26144)

How this story unfolded

Microsoft discloses CVE-2026-26144 in Excel Security Update Guide

Sources

See the full picture, correlated to your attack surface.

Related stories

Multiple Microsoft Excel Remote Code Execution Flaws Added to MSRC Update Guide

Microsoft Windows Kernel Elevation of Privilege Vulnerability (CVE-2026-24289)

Microsoft Excel Use-After-Free Flaw Enables Remote Code Execution

Critical Microsoft Excel Information Disclosure Vulnerability (CVE-2026-26144)

How this story unfolded

Microsoft discloses CVE-2026-26144 in Excel Security Update Guide

Sources

See the full picture, correlated to your attack surface.

Related stories

Multiple Microsoft Excel Remote Code Execution Flaws Added to MSRC Update Guide

Microsoft Windows Kernel Elevation of Privilege Vulnerability (CVE-2026-24289)

Microsoft Excel Use-After-Free Flaw Enables Remote Code Execution