Skip to main content

Microsoft Office Excel CVE-2026-81387

| EUVDEUVD-2026-73856 MEDIUM
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)
2026-09-08 secure@microsoft.com GHSA-wpwv-7jvw-vgv5
Information Disclosure Microsoft 365 Apps Excel Microsoft 365 Office 2021 Office 2024 Office 2019 Office 2016
5.5
CVSS 3.1 · Vendor: microsoft
Share

Severity by source

Vendor (microsoft) PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
vuln.today AI
5.5 MEDIUM

Local file-open required (AV:L, UI:R), no attacker privileges needed (PR:N), confidentiality-only impact with no integrity or availability effect.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

3
Analysis Generated
Sep 08, 2026 - 22:32 vuln.today
Patch available
Sep 08, 2026 - 18:35 EUVD
CVE Published
Sep 08, 2026 - 18:20 cve.org
MEDIUM 5.5

DescriptionCVE.org

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

AnalysisAI

Microsoft Office Excel exposes sensitive system information to an unauthorized control sphere (CWE-497), enabling local information disclosure when a victim opens a specially crafted Excel file. The vulnerability spans Excel 2016 through Microsoft 365 Apps for Enterprise and multiple LTSC editions on both Windows and Mac. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The victim must actively open a specially crafted Excel file on a system running a vulnerable version of Microsoft Office or Microsoft 365 Apps for Enterprise. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS 5.5 (Medium) reflects a local-only attack with required user interaction and no integrity or availability impact, which appropriately moderates the raw C:H confidentiality signal. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the vendor-released patches via Microsoft Update or the Microsoft Update Catalog. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in 365 Apps

View all
CVE-2024-21413 CRITICAL POC
9.8 Feb 13

Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
CVE-2021-42292 HIGH
7.8 Nov 10

Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
CVE-2023-21715 HIGH
7.3 Feb 14

Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
CVE-2026-21509 HIGH POC
7.8 Jan 26

Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
CVE-2026-21514 HIGH
7.8 Feb 10

Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
CVE-2021-38646 HIGH
7.8 Sep 15

Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
CVE-2021-34478 HIGH
7.8 Aug 12

Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
CVE-2021-34501 HIGH
7.8 Jul 14

Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
CVE-2025-47957 HIGH POC
8.4 Jun 10

Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary

CVE-2022-41106 HIGH
8.8 Nov 09

Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
CVE-2023-33148 HIGH POC
7.8 Jul 11

Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack

CVE-2020-0901 CRITICAL
9.8 May 21

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obje

Same weakness CWE-497 – Exposure of Sensitive System Information to an Unauthorized Control Sphere

View all
CVE-2026-34413 HIGH POC
8.8
CVE-2026-41459 MEDIUM POC
6.9
CVE-2022-1902 HIGH POC
8.8
CVE-2022-4985 HIGH POC
8.7
CVE-2018-25358 HIGH POC
8.7
CVE-2020-36922 HIGH POC
7.5
CVE-2020-36926 HIGH POC
7.5
CVE-2026-28698 CRITICAL
9.2

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-81387 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy