Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

CVEs · all collected releases

567 matches in Microsoft Office · most urgent first CSV Text

CVE	Vulnerability	Severity	CVSS	EPSS	Impact	Status	Fixed by
CVE-2026-96951	Windows Shell Security Feature Bypass VulnerabilityWindows Shell	Important	8.8	9.8%	SFBNetwork	ExploitedCISA KEV · due 16 OctFix has a known issueRevised 26 Oct	KB5126646 KB5126651+7
CVE-2026-124194	Microsoft Outlook Spoofing VulnerabilityMicrosoft Office Outlook	Moderate	6.5	—	SpoofingNetwork	ExploitedCISA KEV · due 24 Nov	—
CVE-2026-66302	Skype for Business Remote Code Execution VulnerabilitySkype for Business	Critical	9.8	1.0%	RCENetwork		KB5123287 KB5123300+1
CVE-2026-70242	Microsoft Office Outlook Remote Code Execution VulnerabilityMicrosoft Office Outlook	Critical	9.8	1.6%	RCENetwork		—
CVE-2026-70291	Microsoft Office Outlook Remote Code Execution VulnerabilityMicrosoft Office Outlook	Critical	9.8	1.3%	RCENetwork	Revised 10 Nov	—
CVE-2026-70300	Microsoft Office Word Remote Code Execution VulnerabilityMicrosoft Office Word	Critical	9.8	1.1%	RCENetwork		—
CVE-2026-78509	Microsoft Office Outlook Remote Code Execution VulnerabilityMicrosoft Office Outlook	Critical	9.8	1.0%	RCENetwork	Revised 17 Sep	KB5002923
CVE-2026-88156	Microsoft Office Outlook Remote Code Execution VulnerabilityMicrosoft Office Outlook	Critical	9.8	1.2%	RCENetwork	Revised 15 Oct	—
CVE-2026-88178	Microsoft Office PowerPoint Remote Code Execution VulnerabilityMicrosoft Office PowerPoint	Critical	9.8	1.0%	RCENetwork	Revised 15 Oct	—
CVE-2026-97016	Microsoft Office Outlook Remote Code Execution VulnerabilityMicrosoft Office Outlook	Critical	9.8	1.2%	RCENetwork		—
CVE-2026-97749	Microsoft Office Outlook Remote Code Execution VulnerabilityMicrosoft Office Outlook	Critical	9.8	1.2%	RCENetwork	Revised 10 Nov	—
CVE-2026-100209	Microsoft Office Excel Remote Code Execution VulnerabilityMicrosoft Office Excel	Critical	8.8	1.0%	RCENetwork	Revised 15 Oct	—

Advisories

MSRC guidance without a CVE of its own · 1 advisory

ADV260001

Hardening changes for ReFS volumes on removable mediaStarting with Windows updates released on and after October 13, 2026, Microsoft is making hardening changes to the Resilient File System (ReFS) . This change is not enable by default until 2027. Please see Hardening changes for ReFS volumes on removable media for more information.

Published 13 Oct28 affected products