CVE-2026-45459: Microsoft Excel Auth Bypass Vulnerability

CVE-2026-45459 Overview

CVE-2026-45459 is a protection mechanism failure vulnerability in Microsoft Office Excel. An unauthorized attacker can bypass a security feature locally when a user opens a crafted file. The flaw is classified under [CWE-693] Protection Mechanism Failure.

Exploitation requires local access and user interaction, which reduces the practical attack surface. The vulnerability does not enable code execution or data modification on its own. Instead, it weakens a security control that other attacks may rely on for defense in depth.

Critical Impact
An attacker who convinces a user to open a malicious Excel file locally can bypass an Excel security feature, undermining defense-in-depth protections around document handling.

Affected Products

Microsoft Office Excel (specific versions per Microsoft advisory)
Microsoft 365 Apps deployments that include Excel
Refer to the Microsoft Security Update CVE-2026-45459 advisory for the authoritative product and build list

Discovery Timeline

2026-06-09 - CVE-2026-45459 published to the National Vulnerability Database
2026-06-09 - Last updated in NVD database (modified 2026-06-09)

Technical Details for CVE-2026-45459

Vulnerability Analysis

The vulnerability is a protection mechanism failure in Microsoft Office Excel. Excel implements security features such as Protected View, Mark-of-the-Web enforcement, and macro and external content restrictions. CVE-2026-45459 allows one of these protective controls to be bypassed when an attacker-supplied file is opened locally.

The attack vector is local and requires user interaction. Confidentiality impact is limited, while integrity and availability are not affected per the published CVSS metrics. The EPSS exploit-likelihood data places this issue in the low-probability tier, consistent with bypass-class flaws that are typically chained with other techniques rather than exploited standalone.

Because the flaw weakens a defensive barrier, its primary value to an adversary is enabling follow-on attacks. For example, bypassing a content-block prompt can make a malicious document execute embedded payloads that would otherwise be blocked.

Root Cause

The root cause falls under [CWE-693] Protection Mechanism Failure. Excel fails to consistently enforce a security control under specific document or runtime conditions. Microsoft has not publicly disclosed the precise component, but the failure permits an attacker to evade a check that should have blocked or warned about an unsafe action.

Attack Vector

Exploitation requires the attacker to deliver a crafted Excel file to the victim through email, removable media, file share, or download. The user must then open the file on the local system. No network exploitation path exists, and no elevated privileges are required prior to opening the document.

No verified public proof-of-concept code is available for this CVE. The vulnerability mechanism is documented in the Microsoft Security Update CVE-2026-45459 advisory.

Detection Methods for CVE-2026-45459

Indicators of Compromise

Excel documents arriving from untrusted sources that suppress or evade Protected View prompts
Office telemetry showing macro execution or external content loading without the expected user-consent dialog
Unusual child processes spawned by excel.exe shortly after a document open event

Detection Strategies

Monitor process-creation events where excel.exe is the parent of powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe, or rundll32.exe.
Alert on Excel file opens from internet-derived paths (Downloads, Temp, mail attachment cache) followed by network connections originating from Office processes.
Correlate Mark-of-the-Web attribute presence with subsequent file behavior to identify documents that should have triggered Protected View but did not.

Monitoring Recommendations

Ingest Windows Security, Sysmon, and Microsoft Defender for Endpoint logs into a central data lake for correlation across endpoints.
Track Office Click-to-Run version and patch level across the fleet to identify hosts still vulnerable.
Review Attack Surface Reduction (ASR) rule audit logs for blocked or bypassed Office behaviors.

How to Mitigate CVE-2026-45459

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-45459 advisory across all affected Excel installations.
Verify Office Click-to-Run and Microsoft 365 Apps update channels are current and not paused.
Reinforce user awareness that Excel files from external sources should not be opened outside Protected View.

Patch Information

Microsoft has published a security update through the Microsoft Security Response Center. Administrators should consult the Microsoft Security Update CVE-2026-45459 entry for the specific KB articles, build numbers, and channel-specific releases that contain the fix.

Workarounds

Enable and enforce Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and from injecting code into other processes.
Configure Group Policy to require Protected View for files originating from the internet, attachments, and unsafe locations, and disable user override where feasible.
Block macros in Office files from the internet through the Block macros from running in Office files from the Internet policy until patches are deployed.

bash

# Configuration example: enforce Protected View and block internet macros via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f