What is the CVSS score of EUVD-2026-56451?

EUVD-2026-56451 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Microsoft Office are affected by EUVD-2026-56451?

Microsoft Office contains a local privilege escalation vulnerability (CVE-2026-68792, CVSS 7.8) that allows authenticated users with standard-level privileges to escalate to higher system privileges…

How to fix or mitigate EUVD-2026-56451?

Within 24 hours, inventory all Microsoft Office deployments and identify systems where standard user accounts have local access. Within 7 days, implement application execution policies (Windows AppLocker or equivalent) to prevent Office from spawning command-line interpreters (cmd.exe, powershell.exe), enable audit logging for Office child process creation and privilege escalation attempts, and review user account privilege assignments to minimize unnecessary local access. Within 30 days, monitor Microsoft Security Updates for patch availability and establish a 24-hour deployment plan; apply the patch immediately upon vendor release.

Microsoft Office EUVD-2026-56451

| CVE-2026-68792 HIGH

Command Injection (CWE-77)

2026-08-11 secure@microsoft.com

GHSA-q6gv-265p-p9fg

Command Injection Microsoft 365 Apps Office 2021 Office 2024 Office 2019

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector confirmed by description; PR:L because a standard user account suffices; full C/I/A impact reflects privilege escalation to full system control.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:11 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 7.8

DescriptionCVE.org

Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Office exploits a command injection flaw (CWE-77) that allows an authenticated local attacker to gain elevated privileges on the affected system. The vulnerability requires only low-level privileges to trigger, making it accessible to any standard user account on a compromised or shared system. No public exploit code or CISA KEV listing is identified at time of analysis, but the high-impact CVSS score and Microsoft's own disclosure warrant prompt patching.

Technical ContextAI

CWE-77 (Improper Neutralization of Special Elements used in a Command) describes a class of vulnerabilities where user-controlled input is passed unsanitized to a system-level command interpreter. In the context of Microsoft Office, this likely involves a component that constructs shell or subprocess commands using attacker-influenced data - such as file paths, macro arguments, or embedded metadata - without adequate escaping or allow-listing. The local attack vector (AV:L) confirms exploitation occurs on the host system rather than over a network. CPE data specifying exact affected Office versions was not provided in the input, so version scoping relies solely on the MSRC advisory reference.

RemediationAI

The primary remediation is to apply the patch released by Microsoft via the Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68792. An exact fixed version number was not confirmed in the available input data - consult the MSRC advisory directly for the specific Office build that resolves this issue. Organizations using Microsoft 365 Apps with automatic updates enabled may already be protected if the patch has been deployed. As a compensating control pending patching, restrict local user account privileges to the minimum necessary and audit any Office components that invoke system commands. Note that application allow-listing tools (e.g., AppLocker, Windows Defender Application Control) may limit the impact of successful command injection by restricting what binaries can be launched by Office processes.