endpoint-software-vulnerabilitywidely-deployed-product-advisoryinitial-access-method

Microsoft Patches Repeated Remote Code Execution Flaws Across Office Apps

Vulnerability Disclosure · 49 sources · Updated 4mo ago · First seen May 25, 2026

Microsoft published a long series of security advisories for remote code execution vulnerabilities affecting core Office components, with the largest concentration in Excel and Word. The disclosures include Excel flaws such as CVE-2024-49026, CVE-2024-49069, CVE-2025-21362, CVE-2025-21381, CVE-2025-21387, CVE-2025-24082, CVE-2025-62553, CVE-2026-26107, CVE-2026-26109, CVE-2026-26112, and CVE-2026-40359, alongside Word issues including CVE-2025-24077, CVE-2025-24078, CVE-2025-47170, CVE-2025-49700, CVE-2025-59222, CVE-2026-23657, and CVE-2026-33095. Microsoft also listed related RCE bugs in Microsoft Office (CVE-2025-21392), PowerPoint (CVE-2025-54908), Inbox COM Objects (Global Memory) (CVE-2025-58730), and the Visual Studio Code Python Extension (CVE-2025-49714).

One of the few entries with technical detail, CVE-2026-40359, describes an Important Excel use-after-free flaw (CWE-416) with a CVSS 3.1 score of 7.8 that can let an attacker execute code if a user opens a malicious Office file. Microsoft said the bug was not publicly disclosed, not exploited in the wild, and less likely to be exploited at the time of publication, adding that the Preview Pane is not an attack vector and that a fix is available. Taken together, the advisories show Microsoft continuing to address document-driven code execution risks across Office products, where successful exploitation generally depends on user interaction with crafted files rather than direct network exposure.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

35 events · Nov 12, 2024 – May 12, 2026

May 12, 20266mo ago
Microsoft discloses and fixes Excel RCE flaw CVE-2026-40359
On 2026-05-12, Microsoft disclosed CVE-2026-40359, an Important Excel remote code execution vulnerability caused by a use-after-free flaw. Microsoft said exploitation required user interaction to open a malicious Office file, the Preview Pane was not an attack vector, no in-the-wild exploitation or prior public disclosure was known, and a fix was available; the issue was credited to f4 and Zhiniang Peng of HUST.
Apr 14, 20267mo ago
Microsoft discloses Excel RCE vulnerability CVE-2026-32197
On 2026-04-14, Microsoft published a Security Update Guide entry for CVE-2026-32197, an Important Microsoft Excel remote code execution vulnerability caused by a use-after-free flaw. Microsoft said exploitation required user interaction to open a malicious Office file, the Preview Pane was not an attack vector, no public disclosure or in-the-wild exploitation was known, and a fix was available.
CVE-2026-32197 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution Vulnerability
Apr 14, 20267mo ago
Microsoft discloses Excel RCE vulnerability CVE-2026-32189
On 2026-04-14, Microsoft published a Security Update Guide entry for CVE-2026-32189, an Important Microsoft Excel remote code execution vulnerability caused by a use-after-free flaw. Microsoft said exploitation required user interaction to open a malicious Office file, the Preview Pane was not an attack vector, no public disclosure or in-the-wild exploitation was known, and a fix was available.
CVE-2026-32189 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution Vulnerability
Apr 14, 20267mo ago
Microsoft publishes April 2026 Word RCE advisories
On 2026-04-14, Microsoft disclosed CVE-2026-23657 and CVE-2026-33095, both Microsoft Word remote code execution vulnerabilities. These entries were part of the April 2026 update cycle.
Mar 10, 20268mo ago
Microsoft discloses three Excel RCE vulnerabilities in March 2026
On 2026-03-10, Microsoft published Security Update Guide entries for CVE-2026-26107, CVE-2026-26109, and CVE-2026-26112. All three were identified as Microsoft Excel remote code execution vulnerabilities.
Dec 9, 202511mo ago
Microsoft publishes December 2025 Excel RCE vulnerability CVE-2025-62553
Microsoft released a Security Update Guide entry for CVE-2025-62553, a Microsoft Excel remote code execution vulnerability. The disclosure was published on 2025-12-09.
Oct 14, 20251y ago
Microsoft publishes Excel RCE vulnerability CVE-2025-59224
On 2025-10-14, Microsoft published a Security Update Guide entry for CVE-2025-59224, identifying it as a Microsoft Excel remote code execution vulnerability. The disclosure adds another Office document-handling RCE issue to Microsoft's October 2025 release cycle.
CVE-2025-59224 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution Vulnerability
Oct 14, 20251y ago
Microsoft publishes Excel RCE vulnerability CVE-2025-59223
On 2025-10-14, Microsoft published a Security Update Guide entry for CVE-2025-59223, identifying it as a Microsoft Excel remote code execution vulnerability. The disclosure adds another Office document-handling RCE issue to Microsoft's October 2025 release cycle.
CVE-2025-59223 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution Vulnerability
Oct 14, 20251y ago
Microsoft releases October 2025 Word and Inbox COM Objects RCE advisories
On 2025-10-14, Microsoft published CVE-2025-59222 affecting Word and CVE-2025-58730 affecting Inbox COM Objects (Global Memory). Both were listed as remote code execution vulnerabilities.
Sep 9, 20251y ago
Microsoft publishes Excel RCE vulnerability CVE-2025-54904
Microsoft released a Security Update Guide entry for CVE-2025-54904, identifying it as a Microsoft Excel remote code execution vulnerability. The disclosure was published on 2025-09-09 as part of Microsoft's September 2025 update cycle.
CVE-2025-54904 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution Vulnerability
Sep 9, 20251y ago
Microsoft publishes PowerPoint RCE vulnerability CVE-2025-54908
Microsoft disclosed CVE-2025-54908 as a Microsoft PowerPoint remote code execution vulnerability in the Security Update Guide. The entry was published on 2025-09-09.
Jul 8, 20251y ago
Microsoft discloses Excel RCE vulnerability CVE-2025-49711
On 2025-07-08, Microsoft published a Security Update Guide entry for CVE-2025-49711, identifying it as a Microsoft Excel remote code execution vulnerability. The disclosure adds another Office document-handling RCE issue to Microsoft's July 2025 release cycle.
CVE-2025-49711 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution Vulnerability
Jul 8, 20251y ago
Microsoft discloses July 2025 Word and VS Code Python extension RCE flaws
On 2025-07-08, Microsoft published entries for CVE-2025-49700 affecting Microsoft Word and CVE-2025-49714 affecting the Visual Studio Code Python Extension. Both were classified as remote code execution vulnerabilities.
Jun 10, 20251y ago
Microsoft publishes Word RCE vulnerability CVE-2025-47170
Microsoft released a Security Update Guide entry for CVE-2025-47170, a Microsoft Word remote code execution vulnerability. The disclosure was published on 2025-06-10.
Jun 10, 20251y ago
Microsoft publishes Office RCE vulnerability CVE-2025-47173
Microsoft released a Security Update Guide entry for CVE-2025-47173, identifying it as a Microsoft Office remote code execution vulnerability. The disclosure was published on 2025-06-10 as part of Microsoft's June 2025 update cycle.
CVE-2025-47173 - Security Update Guide - Microsoft - Microsoft Office Remote Code Execution Vulnerability
Mar 11, 20252y ago
Microsoft publishes Word RCE vulnerability CVE-2025-24079
On 2025-03-11, Microsoft published a Security Update Guide entry for CVE-2025-24079, identifying it as a Microsoft Word remote code execution vulnerability. The disclosure adds another Office document-handling RCE issue to Microsoft's March 2025 release cycle.
CVE-2025-24079 - Security Update Guide - Microsoft - Microsoft Word Remote Code Execution Vulnerability
Mar 11, 20252y ago
Microsoft discloses Excel RCE vulnerability CVE-2025-24081
On 2025-03-11, Microsoft published a Security Update Guide entry for CVE-2025-24081, identifying it as a Microsoft Excel remote code execution vulnerability. The disclosure adds another Office document-handling RCE issue to Microsoft's March 2025 release cycle.
CVE-2025-24081 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution Vulnerability
Mar 11, 20252y ago
Microsoft discloses March 2025 Word and Excel RCE flaws
On 2025-03-11, Microsoft published Security Update Guide entries for CVE-2025-24077 and CVE-2025-24078 in Word and CVE-2025-24082 in Excel. The disclosures added multiple Office document-handling remote code execution issues to the March 2025 updates.
Feb 11, 20252y ago
Microsoft publishes Office RCE vulnerability CVE-2025-21397
On 2025-02-11, Microsoft published a Security Update Guide entry for CVE-2025-21397, identifying it as a Microsoft Office remote code execution vulnerability. The disclosure adds another Office-related RCE issue to Microsoft's February 2025 release cycle.
CVE-2025-21397 - Security Update Guide - Microsoft - Microsoft Office Remote Code Execution Vulnerability
Feb 11, 20252y ago
Microsoft discloses Excel RCE vulnerability CVE-2025-21394
On 2025-02-11, Microsoft published a Security Update Guide entry for CVE-2025-21394, identifying it as a Microsoft Excel remote code execution vulnerability. The disclosure adds another Office document-handling RCE issue to Microsoft's February 2025 release cycle.
CVE-2025-21394 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution Vulnerability
Feb 11, 20252y ago
Microsoft publishes February 2025 Office and Excel RCE advisories
On 2025-02-11, Microsoft disclosed CVE-2025-21381 and CVE-2025-21387 affecting Excel, along with CVE-2025-21392 affecting Microsoft Office. These entries indicate multiple remote code execution vulnerabilities addressed in the February 2025 release cycle.
Feb 11, 20252y ago
Microsoft discloses Excel RCE vulnerability CVE-2025-21386
On 2025-02-11, Microsoft published a Security Update Guide entry for CVE-2025-21386, identifying it as a Microsoft Excel remote code execution vulnerability. The disclosure adds another Office document-handling RCE issue to Microsoft's February 2025 release cycle.
CVE-2025-21386 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution Vulnerability
Feb 11, 20252y ago
Microsoft discloses Excel RCE vulnerability CVE-2025-21390
On 2025-02-11, Microsoft published a Security Update Guide entry for CVE-2025-21390, identifying it as a Microsoft Excel remote code execution vulnerability. This adds another Office document-handling RCE issue to Microsoft's February 2025 release cycle.
CVE-2025-21390 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution Vulnerability
Jan 14, 20252y ago
Microsoft discloses Outlook RCE vulnerability CVE-2025-21361
On 2025-01-14, Microsoft published a Security Update Guide entry for CVE-2025-21361, identifying it as a Microsoft Outlook remote code execution vulnerability. The disclosure adds another Office-related RCE issue to Microsoft's January 2025 release cycle.
CVE-2025-21361 - Security Update Guide - Microsoft - Microsoft Outlook Remote Code Execution Vulnerability
Jan 14, 20252y ago
Microsoft discloses Excel RCE vulnerability CVE-2025-21354
On 2025-01-14, Microsoft published a Security Update Guide entry for CVE-2025-21354, identifying it as a Microsoft Excel remote code execution vulnerability. The disclosure adds another Office document-handling RCE issue to Microsoft's January 2025 release cycle.
CVE-2025-21354 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution Vulnerability
Jan 14, 20252y ago
Microsoft discloses Visio RCE vulnerability CVE-2025-21356
On 2025-01-14, Microsoft published a Security Update Guide entry for CVE-2025-21356, identifying it as a Microsoft Office Visio remote code execution vulnerability. The disclosure adds another Office-related RCE issue to Microsoft's January 2025 release cycle.
CVE-2025-21356 - Security Update Guide - Microsoft - Microsoft Office Visio Remote Code Execution Vulnerability
Jan 14, 20252y ago
Microsoft discloses Access RCE vulnerability CVE-2025-21366
On 2025-01-14, Microsoft published a Security Update Guide entry for CVE-2025-21366, identifying it as a Microsoft Access remote code execution vulnerability. The disclosure adds another Office-related RCE issue to Microsoft's January 2025 release cycle.
CVE-2025-21366 - Security Update Guide - Microsoft - Microsoft Access Remote Code Execution Vulnerability
Jan 14, 20252y ago
Microsoft discloses Access RCE vulnerability CVE-2025-21395
On 2025-01-14, Microsoft published a Security Update Guide entry for CVE-2025-21395, identifying it as a Microsoft Access remote code execution vulnerability. The disclosure adds another Office-related RCE issue to Microsoft's January 2025 release cycle.
CVE-2025-21395 - Security Update Guide - Microsoft - Microsoft Access Remote Code Execution Vulnerability
Jan 14, 20252y ago
Microsoft releases January 2025 Office RCE fixes
On 2025-01-14, Microsoft published Security Update Guide entries for CVE-2025-21362, an Excel remote code execution vulnerability. This marks a January Patch Tuesday disclosure affecting Microsoft Office components.
Dec 10, 20242y ago
Microsoft discloses CVE-2024-49069 in Excel
Microsoft published a Security Update Guide entry for CVE-2024-49069, identifying another Microsoft Excel remote code execution vulnerability. The disclosure appeared on 2024-12-10.
Nov 12, 20242y ago
Microsoft discloses Excel RCE vulnerability CVE-2024-49029
On 2024-11-12, Microsoft published a Security Update Guide entry for CVE-2024-49029, identifying it as a Microsoft Excel remote code execution vulnerability. The disclosure adds another Office document-handling RCE issue to Microsoft's November 2024 update cycle.
CVE-2024-49029 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution Vulnerability
Nov 12, 20242y ago
Microsoft discloses Excel RCE vulnerability CVE-2024-49028
On 2024-11-12, Microsoft published a Security Update Guide entry for CVE-2024-49028, identifying it as a Microsoft Excel remote code execution vulnerability. The disclosure adds another Office document-handling RCE issue to Microsoft's November 2024 update cycle.
CVE-2024-49028 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution Vulnerability
Nov 12, 20242y ago
Microsoft discloses Office Graphics RCE vulnerability CVE-2024-49032
On 2024-11-12, Microsoft published a Security Update Guide entry for CVE-2024-49032, identifying it as a Microsoft Office Graphics remote code execution vulnerability. The disclosure adds another Office-related RCE issue to Microsoft's November 2024 update cycle.
CVE-2024-49032 - Security Update Guide - Microsoft - Microsoft Office Graphics Remote Code Execution Vulnerability
Nov 12, 20242y ago
Microsoft discloses Excel RCE vulnerability CVE-2024-49027
Microsoft published a Security Update Guide entry for CVE-2024-49027, identifying it as a Microsoft Excel remote code execution vulnerability. The disclosure was published on 2024-11-12 as part of Microsoft's November 2024 update cycle.
CVE-2024-49027 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution Vulnerability
Nov 12, 20242y ago
Microsoft publishes advisory for CVE-2024-49026 in Excel
Microsoft released a Security Update Guide advisory for CVE-2024-49026, a Microsoft Excel remote code execution vulnerability. The advisory was published on 2024-11-12.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Use-after-free RCE in Microsoft Office Excel (CVE-2026-40359)

Organizations

1 linked

Microsoft Corporation

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

49 references tracked. Mallory keeps watching after this page renders.

Msrc MicrosoftAdvisories · May 12, 2026

CVE-2026-40359 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution VulnerabilityOpen source ↗

Msrc MicrosoftAdvisories · Apr 14, 2026

CVE-2026-23657 - Security Update Guide - Microsoft - Microsoft Word Remote Code Execution VulnerabilityOpen source ↗

Msrc MicrosoftAdvisories · Apr 14, 2026

CVE-2026-32189 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution VulnerabilityOpen source ↗

Msrc MicrosoftAdvisories · Apr 14, 2026

CVE-2026-32197 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution VulnerabilityOpen source ↗

41 additional sources from 12-11-2024 to 14-04-2026

Msrc MicrosoftAdvisories · Nov 12, 2024

CVE-2024-49027 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution VulnerabilityOpen source ↗

Msrc MicrosoftAdvisories · Nov 12, 2024

CVE-2024-49026 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution VulnerabilityOpen source ↗

Msrc MicrosoftAdvisories · Nov 12, 2024

CVE-2024-49028 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution VulnerabilityOpen source ↗

Msrc MicrosoftAdvisories · Nov 12, 2024

CVE-2024-49029 - Security Update Guide - Microsoft - Microsoft Excel Remote Code Execution VulnerabilityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Microsoft Patches Repeated Remote Code Execution Flaws Across Office Apps

Vulnerability Disclosure · 49 sources · Updated 4mo ago · First seen May 25, 2026

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Microsoft Patches Repeated Remote Code Execution Flaws Across Office Apps

How this story unfolded

Microsoft discloses and fixes Excel RCE flaw CVE-2026-40359

Microsoft discloses Excel RCE vulnerability CVE-2026-32197

Microsoft discloses Excel RCE vulnerability CVE-2026-32189

Microsoft publishes April 2026 Word RCE advisories

Microsoft discloses three Excel RCE vulnerabilities in March 2026

Microsoft publishes December 2025 Excel RCE vulnerability CVE-2025-62553

Microsoft publishes Excel RCE vulnerability CVE-2025-59224

Microsoft publishes Excel RCE vulnerability CVE-2025-59223

Microsoft releases October 2025 Word and Inbox COM Objects RCE advisories

Microsoft publishes Excel RCE vulnerability CVE-2025-54904

Microsoft publishes PowerPoint RCE vulnerability CVE-2025-54908

Microsoft discloses Excel RCE vulnerability CVE-2025-49711

Microsoft discloses July 2025 Word and VS Code Python extension RCE flaws

Microsoft publishes Word RCE vulnerability CVE-2025-47170

Microsoft publishes Office RCE vulnerability CVE-2025-47173

Microsoft publishes Word RCE vulnerability CVE-2025-24079

Microsoft discloses Excel RCE vulnerability CVE-2025-24081

Microsoft discloses March 2025 Word and Excel RCE flaws

Microsoft publishes Office RCE vulnerability CVE-2025-21397

Microsoft discloses Excel RCE vulnerability CVE-2025-21394

Microsoft publishes February 2025 Office and Excel RCE advisories

Microsoft discloses Excel RCE vulnerability CVE-2025-21386

Microsoft discloses Excel RCE vulnerability CVE-2025-21390

Microsoft discloses Outlook RCE vulnerability CVE-2025-21361

Microsoft discloses Excel RCE vulnerability CVE-2025-21354

Microsoft discloses Visio RCE vulnerability CVE-2025-21356

Microsoft discloses Access RCE vulnerability CVE-2025-21366

Microsoft discloses Access RCE vulnerability CVE-2025-21395

Microsoft releases January 2025 Office RCE fixes

Microsoft discloses CVE-2024-49069 in Excel

Microsoft discloses Excel RCE vulnerability CVE-2024-49029

Microsoft discloses Excel RCE vulnerability CVE-2024-49028

Microsoft discloses Office Graphics RCE vulnerability CVE-2024-49032

Microsoft discloses Excel RCE vulnerability CVE-2024-49027

Microsoft publishes advisory for CVE-2024-49026 in Excel

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Microsoft disclosed multiple Office and Excel remote code execution flaws

Microsoft patches multiple remote code execution flaws in Office and Windows graphics

Microsoft Patches Critical Office and Word Use-After-Free RCE Flaws

Microsoft Patches Repeated Remote Code Execution Flaws Across Office Apps

How this story unfolded

Microsoft discloses and fixes Excel RCE flaw CVE-2026-40359

Microsoft discloses Excel RCE vulnerability CVE-2026-32197

Microsoft discloses Excel RCE vulnerability CVE-2026-32189

Microsoft publishes April 2026 Word RCE advisories

Microsoft discloses three Excel RCE vulnerabilities in March 2026

Microsoft publishes December 2025 Excel RCE vulnerability CVE-2025-62553

Microsoft publishes Excel RCE vulnerability CVE-2025-59224

Microsoft publishes Excel RCE vulnerability CVE-2025-59223

Microsoft releases October 2025 Word and Inbox COM Objects RCE advisories

Microsoft publishes Excel RCE vulnerability CVE-2025-54904

Microsoft publishes PowerPoint RCE vulnerability CVE-2025-54908

Microsoft discloses Excel RCE vulnerability CVE-2025-49711

Microsoft discloses July 2025 Word and VS Code Python extension RCE flaws

Microsoft publishes Word RCE vulnerability CVE-2025-47170

Microsoft publishes Office RCE vulnerability CVE-2025-47173

Microsoft publishes Word RCE vulnerability CVE-2025-24079

Microsoft discloses Excel RCE vulnerability CVE-2025-24081

Microsoft discloses March 2025 Word and Excel RCE flaws

Microsoft publishes Office RCE vulnerability CVE-2025-21397

Microsoft discloses Excel RCE vulnerability CVE-2025-21394

Microsoft publishes February 2025 Office and Excel RCE advisories

Microsoft discloses Excel RCE vulnerability CVE-2025-21386

Microsoft discloses Excel RCE vulnerability CVE-2025-21390

Microsoft discloses Outlook RCE vulnerability CVE-2025-21361

Microsoft discloses Excel RCE vulnerability CVE-2025-21354

Microsoft discloses Visio RCE vulnerability CVE-2025-21356

Microsoft discloses Access RCE vulnerability CVE-2025-21366

Microsoft discloses Access RCE vulnerability CVE-2025-21395

Microsoft releases January 2025 Office RCE fixes

Microsoft discloses CVE-2024-49069 in Excel

Microsoft discloses Excel RCE vulnerability CVE-2024-49029

Microsoft discloses Excel RCE vulnerability CVE-2024-49028