What is the CVSS score of CVE-2026-65656?

CVE-2026-65656 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Office are affected by CVE-2026-65656?

A high-severity command injection vulnerability in Microsoft Office (365 Apps for Enterprise, Office 2019, LTSC 2021, LTSC 2024) enables arbitrary code execution when users open specially crafted…

How to fix or mitigate CVE-2026-65656?

Within 24 hours: Issue a security advisory restricting opening of Office documents from untrusted sources, enable EDR alerting for suspicious Office process execution, and convene security leadership to assess organizational exposure. Within 7 days: Deploy Group Policy restrictions disabling VBA macros and Dynamic Data Exchange in Office 2019, LTSC 2021, and LTSC 2024 environments; enable Advanced Threat Protection for Office 365 to scan email-based document attachments; pilot these controls on a test user group. Within 30 days: Monitor Microsoft security advisories for CVE-2026-65656 patch availability and establish a rapid-deployment procedure; conduct user awareness training on document handling risks; evaluate application control policies to restrict Office binaries' ability to spawn child processes.

Microsoft Office CVE-2026-65656

EUVD-2026-56427 HIGH

Command Injection (CWE-77)

2026-08-11 secure@microsoft.com

GHSA-f3j3-3cj6-g888

Command Injection Microsoft 365 Apps Office 2021 Office 2024 Office 2019

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-based command injection triggered solely by victim opening a document; no attacker system privileges required; user interaction is mandatory; scope unchanged with full user-level C/I/A impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:35 vuln.today

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.8

DescriptionCVE.org

Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Command injection in Microsoft Office enables local arbitrary code execution with high impact across confidentiality, integrity, and availability, affecting Microsoft 365 Apps for Enterprise, Office 2019, LTSC 2021, and LTSC 2024. Exploitation requires a victim to open a specially crafted Office document, after which unsanitized input reaches a command processor without requiring any attacker-side privileges on the target system. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog as of the available intelligence.

Technical ContextAI

CWE-77 (Improper Neutralization of Special Elements used in a Command) describes a failure to sanitize user-controlled data before it is passed to a system command interpreter, allowing injected shell metacharacters or control sequences to alter command intent. In the context of Microsoft Office, this flaw resides within document processing logic - likely in a parsing subsystem, embedded scripting interface, or file-format handler - where content from a crafted file is incorporated into a local command call without adequate escaping or allowlisting. Affected product lines confirmed by ENISA EUVD-2026-56427 span Microsoft 365 Apps for Enterprise (16.x), Office 2019 (19.x), Office LTSC 2021 (16.x), and Office LTSC 2024 (16.x). The local attack vector (AV:L) confirms the injection occurs within the application's local execution environment rather than via a remotely reachable network service.

RemediationAI

Apply the security updates for all affected Office product lines through the Microsoft Security Release Center at https://aka.ms/OfficeSecurityReleases; the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65656 provides the authoritative patch guidance. Exact fixed build numbers are not independently confirmed from the available data - consult the MSRC page for precise version information per product line and update channel. As compensating controls pending patch deployment, enforce Protected View policies via Group Policy to ensure documents downloaded from the internet or email are opened in a sandboxed read-only mode, which reduces the attack surface by preventing active content from executing on open; note this may disrupt workflows requiring immediate editing of external documents. Enforcing Mark of the Web (MOTW) propagation through email gateway and browser settings ensures downloaded files carry the trust zone signal that triggers Protected View. Restricting document execution from untrusted network shares via Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint provides an additional layer, though this does not substitute for patching.