What is the CVSS score of CVE-2026-45459?

CVE-2026-45459 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-45459?

Yes, a patch is available for CVE-2026-45459. Update the affected software to the latest version immediately.

Microsoft Office Excel CVE-2026-45459

EUVD-2026-35541 LOW

Protection Mechanism Failure (CWE-693)

2026-06-09 secure@microsoft.com

GHSA-chvc-7qm7-3qgf

Authentication Bypass Microsoft 365 Apps Microsoft 365 Office 2021 Office 2024

3.3

CVSS 3.1 · Vendor: microsoft

Temporal: 2.9

Severity by source

Vendor (microsoft) PRIMARY

3.3 LOW

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CIRCL (temporal)

2.9 LOW

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:48 vuln.today

DescriptionCVE.org

Protection mechanism failure in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally.

AnalysisAI

Excel across multiple Microsoft Office product lines fails to properly enforce an internal protection mechanism, enabling a local attacker to bypass a security feature and access limited confidential data within the process context. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2024, and Mac variants of Office. With a CVSS score of 3.3, this is a low-severity finding - no public exploit has been identified at time of analysis, and exploitation requires both local system access and deliberate user interaction.

Technical ContextAI

The root cause is classified as CWE-693 (Protection Mechanism Failure), indicating that Excel contains a security control - likely related to its file protection model, macro security boundary, Protected View enforcement, or a similar defense layer - that can be circumvented rather than directly attacked. The CVSS vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N confirms local-only exploitation with low complexity once the attacker can influence the victim's file interaction. The scope is unchanged (S:U), meaning the bypass cannot be leveraged to escalate privileges beyond the Excel process itself. No CPE strings were provided in the source intelligence, but EUVD data identifies the affected product lines as Microsoft 365 Apps for Enterprise (build 16.0.1), Microsoft Office LTSC 2024 (build 16.0.0), Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Microsoft Office 365 for Mac.

RemediationAI

Apply the Microsoft security update referenced at https://aka.ms/OfficeSecurityReleases, which addresses Microsoft 365 Apps for Enterprise (builds above 16.0.1) and Microsoft Office LTSC 2024 (builds above 16.0.0). Exact patched build numbers are not independently confirmed from the provided data - consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45459 for the authoritative fix version. For Mac variants (Office LTSC for Mac 2021, LTSC for Mac 2024, and Office 365 for Mac), apply available updates via Microsoft AutoUpdate. Where immediate patching is not feasible, enforce Protected View for files originating from the internet or untrusted sources via Group Policy (note: this raises the bar by adding a required click-through but does not eliminate the underlying mechanism failure). Additionally, user awareness training to avoid opening Excel files from untrusted senders reduces the UI:R dependency the attacker relies upon.