CVE-2026-55136: Microsoft 365 Apps RCE Vulnerability

CVE-2026-55136 Overview

CVE-2026-55136 is an untrusted pointer dereference vulnerability [CWE-822] in Microsoft Office Excel that enables local code execution. An attacker crafts a malicious spreadsheet that, when opened by a user, causes Excel to dereference an attacker-controlled pointer. Successful exploitation runs arbitrary code in the context of the current user.

The flaw affects multiple Microsoft Office branches, including Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021, Office 2024, and Office Online Server. Exploitation requires user interaction, typically opening a weaponized .xlsx or .xls file delivered through phishing or file-sharing channels.

Critical Impact
Successful exploitation yields arbitrary code execution as the logged-on user, enabling malware installation, credential theft, and lateral movement pivots from the compromised workstation.

Affected Products

Microsoft 365 Apps (x64 and x86, Enterprise)
Microsoft Excel 2016, Office 2019, Office 2021 LTSC, Office 2024 LTSC (Windows and macOS)
Microsoft Office Online Server

Discovery Timeline

2026-07-14 - CVE-2026-55136 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-55136

Vulnerability Analysis

The vulnerability is classified under [CWE-822: Untrusted Pointer Dereference]. Excel reads a pointer value from attacker-influenced data in a spreadsheet file and dereferences it without validating that the pointer references a legitimate object in memory. When the dereference occurs, the process reads from or writes to an address the attacker chose, which can be shaped into a controlled code execution primitive.

Exploitation requires the victim to open a malicious document. The attack vector is Local because delivery relies on user interaction with a file. The confidentiality, integrity, and availability impacts are all High because the resulting code executes with the user's privileges. Attackers typically deliver the payload through spearphishing attachments or drive-by download of Office documents.

Root Cause

The root cause is missing validation of a pointer parsed from a structured Excel file format. Fields inside record streams are trusted and used directly as memory references. An attacker crafts record entries that place a chosen value where Excel expects a valid pointer, so subsequent access resolves to attacker-controlled memory rather than a sanctioned object.

Attack Vector

An attacker constructs a malicious workbook that contains malformed record structures. The file is delivered by email attachment, cloud share, or web download. When the target opens the file — or, in preview-enabled configurations, when the file is rendered — Excel parses the crafted records and dereferences the untrusted pointer, transferring control to attacker-supplied logic. Office Online Server is affected as a server-side render path when it processes attacker-controlled documents.

No public proof-of-concept exploit is listed at time of publication, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. Microsoft's security advisory is available at the Microsoft Security Response Center.

Detection Methods for CVE-2026-55136

Indicators of Compromise

Excel process (EXCEL.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, rundll32.exe, or mshta.exe.
Unusual crashes or exception events in EXCEL.EXE correlated with opening a specific .xls, .xlsx, .xlsm, or .xlsb file.
Newly created executables, scripts, or scheduled tasks in user-writable directories shortly after a document is opened.
Outbound network connections initiated by EXCEL.EXE to previously unseen IPs or domains.

Detection Strategies

Hunt for parent-child process relationships where EXCEL.EXE is the parent of a scripting or LOLBin process.
Alert on Office applications writing PE files, .dll, .js, .vbs, or .hta payloads to %TEMP%, %APPDATA%, or %PUBLIC%.
Correlate Windows Error Reporting events for Excel access violations against subsequent process creation activity on the same host.
Inspect email and web gateways for spreadsheet attachments with anomalous record streams or unusually large BIFF structures.

Monitoring Recommendations

Enable module load and image load telemetry on Office processes and forward to a central analytics tier for behavioral review.
Track Office Online Server render workers for crashes and abnormal process spawning to identify server-side exploitation attempts.
Baseline normal Office child-process behavior per business unit and alert on deviations.

How to Mitigate CVE-2026-55136

Immediate Actions Required

Apply Microsoft's July 2026 security update for all affected Office channels, including Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021, Office 2024, and Office Online Server.
Prioritize patching for workstations that routinely process externally sourced spreadsheets, such as finance and procurement endpoints.
Update Office Online Server instances that render user-submitted workbooks.
Instruct users to avoid opening unexpected spreadsheet attachments until patches are deployed.

Patch Information

Microsoft has released updates addressing CVE-2026-55136 through the standard Office update channels. Refer to the Microsoft Security Vulnerability CVE-2026-55136 advisory for build numbers per product and channel. For Click-to-Run installations, force update via OfficeC2RClient.exe /update user. For MSI-based installs, deploy the corresponding security update through WSUS, Microsoft Configuration Manager, or Intune.

Workarounds

Enable Protected View and Office Application Guard so untrusted spreadsheets open in an isolated container.
Configure Attack Surface Reduction rules to block Office applications from creating child processes and from writing executable content.
Use Group Policy to block macros and external content in files originating from the internet (Mark-of-the-Web enforcement).
Restrict inbound spreadsheet file types at email and web gateways where business processes allow.

bash

# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Enable ASR rule: Block Office applications from injecting code into other processes
Set-MpPreference -AttackSurfaceReductionRules_Ids 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 -AttackSurfaceReductionRules_Actions Enabled

# Force Click-to-Run Office update
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user