CVE-2026-64918: Microsoft 365 Apps Auth Bypass Vulnerability

CVE-2026-64918 Overview

CVE-2026-64918 is a credential exposure vulnerability in Microsoft Office that permits an unauthenticated network attacker to conduct spoofing attacks. The flaw is classified under CWE-522 (Insufficiently Protected Credentials) and requires user interaction to exploit. An attacker who successfully lures a target into opening or interacting with a crafted resource can capture authentication material transmitted by Office. The captured credentials enable spoofing of the victim on the network, undermining trust boundaries between Office clients and remote services. Microsoft published its advisory through the MSRC Update Guide.

Critical Impact
Successful exploitation exposes user credentials over the network, allowing attackers to impersonate legitimate users and access resources under their identity.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2016, 2019 (x86 and x64)
Microsoft Office 2021 LTSC and Office 2024 LTSC (x86 and x64)

Discovery Timeline

2026-09-08 - CVE-2026-64918 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-64918

Vulnerability Analysis

The vulnerability resides in how Microsoft Office handles credential material during network operations. Office applications transmit or store authentication data without adequate protection, exposing it to interception or extraction by an attacker positioned to receive it. The flaw does not grant code execution or data modification. It compromises the confidentiality of credentials, which an attacker can then reuse to impersonate the victim against network services.

Exploitation requires the victim to interact with attacker-controlled content, such as opening a document that triggers an outbound authentication request. Because Office is widely deployed across enterprise environments, harvested credentials often carry access to internal file shares, SharePoint sites, or Exchange resources. The EPSS score for this issue is 0.477% as of 2026-09-10, indicating a low probability of near-term mass exploitation, though targeted campaigns remain plausible.

Root Cause

The root cause is insufficient protection of credentials [CWE-522]. Office code paths transmit or expose authentication tokens, hashes, or related secrets in a form that an unauthorized network observer can capture. Microsoft's advisory does not detail the specific component, but the pattern is consistent with NTLM hash leakage or similar credential-relay scenarios triggered by embedded content, remote templates, or linked resources.

Attack Vector

The attack originates over a network and requires the target to open or interact with malicious content. A typical scenario involves an attacker delivering an Office document by email or link that references a remote resource under attacker control. When Office resolves the reference, it initiates an authenticated network request. The attacker records the exchanged credentials and replays them against services that accept the same authentication scheme. Refer to the Microsoft CVE-2026-64918 Advisory for vendor-specific technical details.

No public proof-of-concept code or exploit is currently available for this vulnerability.

Detection Methods for CVE-2026-64918

Indicators of Compromise

Outbound SMB, WebDAV, or HTTP authentication requests from Office processes (winword.exe, excel.exe, powerpnt.exe) to unfamiliar external hosts.
Office documents containing remote template references, external image links, or embedded objects pointing to attacker-controlled infrastructure.
Anomalous NTLM authentication attempts originating from user endpoints against external IP addresses.

Detection Strategies

Monitor endpoint telemetry for Office applications initiating network connections on ports 445, 139, 80, and 443 to non-corporate destinations.
Inspect inbound documents for URLs that reference file://, \\, or http(s):// resources triggering silent authentication.
Correlate authentication logs across identity providers to detect credential reuse patterns following document open events.

Monitoring Recommendations

Enable Office telemetry and forward logs to a centralized SIEM for correlation with network authentication events.
Alert on NTLM authentication attempts leaving the corporate boundary, which should be rare in most environments.
Track user reports of unexpected credential prompts triggered by Office documents.

How to Mitigate CVE-2026-64918

Immediate Actions Required

Apply the security updates referenced in the Microsoft CVE-2026-64918 Advisory across all affected Office installations.
Block outbound SMB (TCP 445) and WebDAV traffic to untrusted networks at the perimeter firewall.
Enforce SMB signing and disable NTLM where feasible in favor of Kerberos or modern authentication.

Patch Information

Microsoft has released updates for Microsoft 365 Apps and Office 2016, 2019, 2021 LTSC, and 2024 LTSC. Administrators should deploy the latest cumulative updates via Microsoft Update, Windows Server Update Services (WSUS), or the Microsoft 365 Apps update channels. Verify remediation by confirming build numbers against those listed in the vendor advisory.

Workarounds

Configure Group Policy to restrict NTLM outgoing traffic to remote servers, limiting credential exposure.
Disable automatic download of linked content in Office via the DisableAutomaticUpdateLinks and DisableLinkedContent policies.
Deploy Attack Surface Reduction rules to block Office applications from creating outbound network connections to untrusted destinations.

bash

# Configuration example: Restrict outgoing NTLM via Group Policy (registry equivalent)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" /v RestrictSendingNTLMTraffic /t REG_DWORD /d 2 /f

# Block SMB outbound at the host firewall
netsh advfirewall firewall add rule name="Block Outbound SMB" dir=out action=block protocol=TCP remoteport=445