Microsoft Excel CVE-2026-97740

Exploitation requires the victim to open an attacker-crafted Excel document (CVSS UI:R) in a vulnerable Office build - there is no remotely reachable service, so the file must first be delivered (email, web, or share) and opened by a user. No authentication or prior privileges are needed on the target (PR:N), and default configurations of affected Microsoft Office Excel versions are impacted (Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, Office for Mac 2021/2024, Office 365 for Mac, and Office Online Server before 16.0.10417.20228). The primary limiting factor is the mandatory user interaction, which prevents automated/wormable exploitation (SSVC Automatable: no); impact is confined to disclosure of sensitive information with no integrity or availability effect.

This is a moderate-severity information-disclosure flaw (CVSS 6.5) in Microsoft Office Excel. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) describes an unauthenticated, network-delivered attack of low complexity that leaks confidential data (C:H) but cannot alter or destroy it (I:N/A:N) - and crucially it requires user interaction (UI:R), meaning a victim must open an attacker-supplied file. The signals are internally consistent and point to LOW real-world urgency despite the HIGH confidentiality impact: CISA's SSVC framework rates Exploitation as 'none' (no observed or public exploitation), Automatable as 'no' (the required user interaction prevents mass/worm-style abuse), and Technical Impact as 'partial'. The vulnerability is NOT in CISA KEV and no public proof-of-concept is referenced. No EPSS probability score was provided in the input, so quantitative exploitation likelihood cannot be stated; however, the SSVC 'none'/'not automatable' rating and absence of KEV/POC together argue this is a high-CVSS-confidentiality issue rather than an actively pressing threat. The AV:N label follows Microsoft's convention for file-delivered Office attacks (the malicious document arrives over a network) rather than a true remote service exploit - defenders should read this as 'open a malicious spreadsheet', not 'remotely reachable listener'.

An attacker crafts a malicious Excel spreadsheet and delivers it via phishing email, a shared drive, or a web download. When the victim opens the file in a vulnerable version of Excel, the flaw (CWE-497) causes sensitive system information to be disclosed back to the attacker. No public exploit code is identified at the time of analysis, and successful exploitation hinges entirely on convincing the user to open the file.