CVE-2026-62804: Microsoft 365 Apps RCE Vulnerability

CVE-2026-62804 Overview

CVE-2026-62804 is a local code execution vulnerability in Microsoft Office Word caused by external control of file name or path [CWE-73]. An attacker can craft a document that, when opened by a user, causes Word to load resources from an attacker-controlled location and execute code in the context of the current user. The flaw affects supported versions of Microsoft 365 Apps, Microsoft 365 for macOS, and standalone Office 2016, 2019, 2021, and 2024 installations. Exploitation requires user interaction, typically opening a weaponized .docx or related file delivered via phishing or an untrusted file share.

Critical Impact

Successful exploitation grants full confidentiality, integrity, and availability impact on the victim workstation, enabling code execution as the logged-in user.

Affected Products

• Microsoft 365 Apps (Enterprise, x86 and x64)
• Microsoft 365 for macOS
• Microsoft Office 2016, 2019, 2021 (LTSC, including macOS), and 2024 (LTSC)

Discovery Timeline

• 2026-09-08 - CVE-2026-62804 published to the National Vulnerability Database
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-62804

Vulnerability Analysis

The vulnerability is categorized as external control of file name or path [CWE-73]. Microsoft Word accepts a file name or path value that is influenced by attacker-supplied input inside a document. Word then uses this value to locate and load a resource without adequately validating that the target is inside a trusted directory. When the resolved path points to an attacker-controlled binary, library, or template, Word loads it and executes code in the context of the current user.

The attack is local because the malicious document must be opened on the target system. However, delivery typically occurs remotely through email attachments, chat platforms, or shared drives. Because execution occurs in the user session, an attacker inherits the user's file system access, network reach, and cached credentials, creating a foothold for lateral movement and persistence.

Root Cause

The root cause is insufficient validation of file path input consumed by Word during document processing. When the application constructs a path from document-supplied fields, it does not enforce canonicalization or restrict lookups to trusted locations, so attacker-controlled data reaches file-loading APIs.

Attack Vector

The attack vector is local with required user interaction. An attacker crafts an Office document that references an external file name or path, delivers the document to the target, and relies on the victim to open it. Refer to the Microsoft Security Update CVE-2026-62804 advisory for authoritative technical details.

Detection Methods for CVE-2026-62804

Indicators of Compromise

• Microsoft Word (WINWORD.EXE) spawning unusual child processes such as cmd.exe, powershell.exe, wscript.exe, or mshta.exe.
• Word processes reading or loading files from UNC paths, WebDAV shares, or user-writable temporary directories.
• Unexpected outbound SMB or HTTP connections initiated by WINWORD.EXE shortly after a document is opened.
• New or modified files under %APPDATA%\Microsoft\Templates or %APPDATA%\Microsoft\Word\STARTUP following document activity.

Detection Strategies

• Hunt for process lineage where Office applications launch script interpreters or LOLBins, correlated with recent document opens.
• Monitor Windows Sysmon Event ID 7 (Image Loaded) for DLLs loaded by WINWORD.EXE from non-standard directories.
• Inspect inbound email attachments and shared documents for embedded external references, remote templates, or unusual field codes.

Monitoring Recommendations

• Enable Microsoft Defender attack surface reduction (ASR) rule audit and alerting for "Block Office applications from creating child processes."
• Forward Office telemetry, Sysmon, and endpoint identification logs into a centralized data lake for cross-host correlation.
• Track outbound SMB (TCP/445) and WebDAV traffic originating from user endpoints, which is a common exfiltration or payload retrieval channel for path-abuse exploits.

How to Mitigate CVE-2026-62804

Immediate Actions Required

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62804 to all affected Office installations.
• Prioritize patching internet-facing users, executive workstations, and shared collaboration hosts that regularly receive external documents.
• Confirm that Office update channels (Current, Monthly Enterprise, Semi-Annual) are healthy and pushing the latest builds to managed endpoints.

Patch Information

Microsoft has released updates through the standard Office servicing channels for Microsoft 365 Apps, Microsoft 365 for macOS, and Office 2016, 2019, 2021, and 2024. See the Microsoft Security Update CVE-2026-62804 advisory for the specific build numbers per SKU and platform.

Workarounds

• Enable Protected View and Office Application Guard for documents originating from the internet or other untrusted locations.
• Configure Microsoft Defender ASR rules to block Office child process creation and block Win32 API calls from Office macros.
• Block outbound SMB (TCP/445) and WebDAV from user workstations at the perimeter to prevent retrieval of attacker-hosted payloads.
• Deliver user awareness reminders about opening unexpected .docx, .dotm, or .rtf attachments, especially those prompting to enable content.

# Example: enable ASR rule to block Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A \
                 -AttackSurfaceReductionRules_Actions Enabled