What is the CVSS score of CVE-2026-68810?

CVE-2026-68810 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Excel are affected by CVE-2026-68810?

Microsoft Excel vulnerability CVE-2026-68810 enables arbitrary code execution when employees open specially crafted documents, with no patch currently available from the vendor.. A patch is available.

How to fix or mitigate CVE-2026-68810?

Within 24 hours, inventory all Microsoft Excel deployments and issue a mandatory user advisory prohibiting opening of unsolicited or unexpected Excel files, with particular emphasis on email attachments. Within 7 days, deploy Microsoft Attack Surface Reduction rules to block Office child process creation, enforce Office macro execution policy set to block all macros by default, and implement email gateway file type filtering to quarantine .xlsx and .xlsm files from external sources. Within 30 days, establish continuous monitoring for any public exploit availability, request patching timeline from Microsoft, and prepare staged patch deployment procedures to enable immediate application upon vendor release.

Microsoft Excel CVE-2026-68810

EUVD-2026-56462 HIGH

Untrusted Pointer Dereference (CWE-822)

2026-08-11 secure@microsoft.com

GHSA-q563-hwx6-h22r

Authentication Bypass Microsoft 365 Apps Excel Microsoft 365 Office 2021 Office 2024 Office 2019

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File-based local trigger (AV:L), no attacker privileges needed (PR:N), user must open file (UI:R), full code execution impact (C/I/A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 18:03 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 7.8

DescriptionCVE.org

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

AnalysisAI

Untrusted pointer dereference in Microsoft Office Excel enables local arbitrary code execution when a user opens a crafted document. The flaw (CWE-822) allows an attacker who can deliver a malicious file to achieve full code execution with high confidentiality, integrity, and availability impact on the victim's system. No public exploit has been identified at time of analysis, and Microsoft has not listed this in CISA's Known Exploited Vulnerabilities catalog.

Technical ContextAI

CWE-822 (Untrusted Pointer Dereference) arises when an application uses a pointer value derived from untrusted input - such as values embedded in a crafted spreadsheet file - without validating that the pointer references a safe memory location. In Excel's case, this likely occurs during parsing of a malformed workbook structure (e.g., a crafted .xlsx or legacy binary format record), causing the application to dereference an attacker-controlled address and redirect execution flow. The CVSS vector AV:L indicates the vulnerability is triggered in the local execution context, consistent with file-based delivery rather than a network-exposed service. The affected product is Microsoft Office Excel; exact version ranges are not confirmed in the available CPE data.

RemediationAI

The primary remediation is to apply Microsoft's official patch via Windows Update or the Microsoft Update Catalog; the exact fixed build version is not independently confirmed from the available data and must be obtained from the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68810. As a compensating control while patching is pending, organizations should configure Protected View policies via Group Policy to force Excel to open externally-sourced and email-attached files in read-only sandboxed mode, which prevents code execution on open. Additionally, consider enabling Attack Surface Reduction (ASR) rules in Microsoft Defender - specifically the rule blocking Office applications from creating child processes - to limit the impact of successful exploitation. Blocking macro execution from internet-sourced documents via Trust Center settings adds a further layer, though this vulnerability appears to be triggered at the parsing stage rather than via macros.