Loading story…
SafeBreach Labs disclosed weaknesses in Microsoft’s Python in Excel feature that enabled privilege escalation in its Azure-hosted execution containers. A symbolic-link flaw in the file-upload mechanism allowed an unprivileged jovyan container user to become root, exposing an internal configuration file containing backend architectural details and hostnames. The researcher also found that Python in Excel container images could be pulled anonymously and that some builds included an undocumented AI-agent framework.
A separate flaw, tracked as CVE-2026-45459, bypassed Excel’s Trusted Records protection through a Python rich-value web-image object. An attacker could cause a victim’s Excel client to silently retrieve an attacker-controlled URL and upload the retrieved data to the nominally network-isolated Python container. Microsoft received the reports through responsible disclosure, patching the container escalation path in March 2026 and the Excel-side issue on June 9, 2026; the findings were later presented at DEF CON 34.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft patched CVE-2026-45459 to prevent Excel from initiating a network connection based on a web-image object returned by Python code.
SafeBreach separately reported an Excel-side Trusted Records bypass that used a Python rich-value web-image object to silently fetch an attacker-controlled URL and upload fetched data into the isolated container. Microsoft assigned the issue CVE-2026-45459.
Microsoft released version 16.0.19828.43251 to resolve the container privilege-escalation path, including symlink checks across relevant file operations.
SafeBreach reported a symbolic-link privilege-escalation flaw, anonymous container-image access, configuration exposure, and undocumented AI-framework findings in Microsoft’s Python in Excel Azure environment. The flaw could elevate the unprivileged jovyan user to root within a container.
Ron Ben Yizhak publicly presented the Python in Excel container-isolation and Trusted Records bypass research at DEF CON 34.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **`CVE-2026-62870`**, a high-severity remote code execution vulnerability in **Microsoft Excel** caused by a use-after-free flaw. The bug carries a **CVSS v3.1 score of 8.8** and affects **Microsoft 365 Apps for Enterprise**, **Excel 2016**, **Office 2019**, **Office LTSC 2021**, and **Office LTSC 2024** on both **32-bit** and **x64-based** systems. According to the advisory, an unauthenticated attacker could exploit the flaw over a network by delivering a specially crafted Excel file and executing code in the context of the current user. Microsoft released security updates addressing the issue, and reporting indicates exploitation requires **user interaction** to open the malicious file. Successful compromise could let attackers install malware, steal data, and pivot further into enterprise environments depending on the victim's privileges. At the time of publication, there was **no public exploit** and **no confirmed active exploitation**, and the vulnerability had **not** been added to **CISA's Known Exploited Vulnerabilities catalog**.
Aug 4, 2026
Microsoft published a long series of security advisories for **remote code execution** vulnerabilities affecting core Office components, with the largest concentration in **Excel** and **Word**. The disclosures include Excel flaws such as `CVE-2024-49026`, `CVE-2024-49069`, `CVE-2025-21362`, `CVE-2025-21381`, `CVE-2025-21387`, `CVE-2025-24082`, `CVE-2025-62553`, `CVE-2026-26107`, `CVE-2026-26109`, `CVE-2026-26112`, and `CVE-2026-40359`, alongside Word issues including `CVE-2025-24077`, `CVE-2025-24078`, `CVE-2025-47170`, `CVE-2025-49700`, `CVE-2025-59222`, `CVE-2026-23657`, and `CVE-2026-33095`. Microsoft also listed related RCE bugs in **Microsoft Office** (`CVE-2025-21392`), **PowerPoint** (`CVE-2025-54908`), **Inbox COM Objects (Global Memory)** (`CVE-2025-58730`), and the **Visual Studio Code Python Extension** (`CVE-2025-49714`). One of the few entries with technical detail, **`CVE-2026-40359`**, describes an **Important** Excel use-after-free flaw (`CWE-416`) with a **CVSS 3.1 score of 7.8** that can let an attacker execute code if a user opens a malicious Office file. Microsoft said the bug was **not publicly disclosed**, **not exploited in the wild**, and **less likely** to be exploited at the time of publication, adding that the **Preview Pane is not an attack vector** and that a fix is available. Taken together, the advisories show Microsoft continuing to address document-driven code execution risks across Office products, where successful exploitation generally depends on **user interaction with crafted files** rather than direct network exposure.
Jun 29, 2026
Microsoft published security advisories for several **remote code execution** vulnerabilities affecting **Microsoft Office** and **Microsoft Excel**, including `CVE-2025-24057`, `CVE-2025-24075`, and `CVE-2025-47162`. The issues were listed in the Microsoft Security Update Guide as Office-family flaws that could allow arbitrary code execution if successfully exploited. The disclosures indicate that the affected attack surface spans both the broader Office suite and Excel specifically, underscoring continued risk from malicious documents and content processed by productivity software. Organizations using Microsoft Office should prioritize review of the relevant advisories and deployment of associated security updates for the affected products tied to these CVEs.
Jul 12, 2026