What is the CVSS score of CVE-2026-68811?

CVE-2026-68811 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Excel are affected by CVE-2026-68811?

A type confusion vulnerability in Microsoft Office Excel (CVE-2026-68811) enables local code execution when users open specially crafted files, with no attacker privileges required, making it an…. A patch is available.

How to fix or mitigate CVE-2026-68811?

Within 24 hours, disable macros by default across all Excel installations via Group Policy or equivalent controls, alert all users to avoid opening Excel files from untrusted sources, and restrict email attachments to block spreadsheet file formats (.xlsx, .xls, .xlsm, .xlt). Within 7 days, implement network-layer controls including blocking Excel file downloads from the internet, deploy endpoint detection and response tools configured to monitor for anomalous Excel process activity, and conduct organization-wide security awareness training emphasizing phishing risks. Within 30 days, establish a monitoring process for vendor security advisories, develop and test a patch deployment workflow with a pilot group, and maintain user reporting channels for suspicious files.

Microsoft Excel CVE-2026-68811

EUVD-2026-56463 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-08-11 secure@microsoft.com

GHSA-656m-qv56-43cq

Authentication Bypass Memory Corruption Microsoft 365 Apps Excel Microsoft 365 Office 2021 Office 2024 Office 2019

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File-open trigger requires local access (AV:L), no attacker privileges needed (PR:N), user must open file (UI:R); full process compromise yields C/I/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 18:03 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 7.8

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

AnalysisAI

Type confusion (CWE-843) in Microsoft Office Excel enables local code execution when a victim opens a specially crafted file. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms the attack is file-based: no attacker privileges are required, but the target user must open a malicious document, making this a high-impact phishing-delivery vector. No public exploit code and no CISA KEV listing are identified at time of analysis, but the full confidentiality, integrity, and availability impact (C:H/I:H/A:H) makes this a critical priority for organizations where Excel is deployed.

Technical ContextAI

CWE-843 (Access of Resource Using Incompatible Type - Type Confusion) occurs when code allocates or accesses a memory region expecting one data type but interprets it as another incompatible type. In spreadsheet applications like Excel, this class of bug commonly arises in formula parsers, object model handling, or binary/OOXML deserialization routines, where internal type coercion assumptions can be violated by attacker-controlled input embedded in a document. The 'Memory Corruption' tag corroborates that the type mismatch leads to out-of-bounds read or write conditions, which attackers can leverage to achieve arbitrary code execution within the Excel process. Reported by secure@microsoft.com and tracked under the Microsoft Security Response Center (MSRC) advisory system.

RemediationAI

Apply the Microsoft security update published via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68811. Patch available per vendor advisory; a specific fix version number was not present in the available input data and must be confirmed from MSRC. While patching is completed, enable Protected View for files originating from the internet or email attachments (File > Options > Trust Center > Protected View) - this prevents automatic macro and formula execution, raising the bar for exploitation though it may affect workflow for users who habitually enable editing. Organizations should also consider disabling Excel's ability to open SYLK, XLM legacy macro formats, or other deprecated formats if not operationally required, as these are common exploit delivery vehicles for type confusion bugs. Block execution of Excel spawning child processes via endpoint security controls as an additional compensating layer.