CVE-2026-65807: Microsoft 365 Apps RCE Vulnerability

CVE-2026-65807 Overview

CVE-2026-65807 is a type confusion vulnerability in Microsoft Office Excel that allows an unauthorized attacker to execute code over a network. The flaw is tracked under CWE-843: Access of Resource Using Incompatible Type. Exploitation requires user interaction, typically opening a malicious spreadsheet delivered via email, file share, or web download.

Successful exploitation grants the attacker code execution in the context of the current user. The vulnerability affects Microsoft 365 Apps, Excel 2016, Microsoft 365 for macOS, and Office 2019, 2021, and 2024 across Windows and macOS platforms.

Critical Impact
A crafted Excel document can trigger arbitrary code execution on the target host, providing an initial access foothold suitable for ransomware staging, credential theft, or lateral movement.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Excel 2016 (x64 and x86)
Microsoft 365 for macOS
Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024 (Windows and macOS)

Discovery Timeline

2026-08-11 - CVE-2026-65807 published to the National Vulnerability Database
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-65807

Vulnerability Analysis

The vulnerability stems from Excel accessing an object using a type that is incompatible with the object's actual type. When a crafted spreadsheet is parsed, Excel interprets memory as a different structure than the one originally allocated. This mismatch enables attacker-controlled data to be treated as a valid pointer, function reference, or size field.

Type confusion flaws of this class allow attackers to bypass memory safety assumptions built into the parser and object model. The attacker chains the incorrect type interpretation into a write-what-where primitive or a controlled indirect call, leading to arbitrary code execution in the Excel process.

The scope remains unchanged, meaning code executes with the privileges of the user who opened the document. On workstations where users routinely operate with local administrator rights, this expands the blast radius significantly.

Root Cause

The root cause is improper type validation during deserialization or evaluation of Excel document structures. Excel dereferences an object assuming one type layout while the underlying memory was created for another, violating type safety guarantees ([CWE-843]).

Attack Vector

The attack vector is network-based delivery of a malicious workbook. An attacker sends the file through phishing, hosts it on a compromised or attacker-controlled site, or drops it into a shared drive. The victim opens the file in a vulnerable Excel version, and the parser triggers the type confusion. No additional privileges are required prior to exploitation.

Refer to the Microsoft Security Update Guide for CVE-2026-65807 for authoritative technical detail.

Detection Methods for CVE-2026-65807

Indicators of Compromise

Excel spawning child processes such as cmd.exe, powershell.exe, rundll32.exe, mshta.exe, or wscript.exe.
Unexpected outbound network connections originating from EXCEL.EXE shortly after a document open event.
Newly written executables, scripts, or DLLs in %APPDATA%, %TEMP%, or %PUBLIC% following spreadsheet activity.
Office documents arriving from external senders with macros disabled but containing embedded objects or unusual XML parts.

Detection Strategies

Hunt for process ancestry where EXCEL.EXE is the parent of a scripting or living-off-the-land binary.
Alert on Excel loading unsigned or unusual DLLs into its address space.
Correlate email gateway telemetry with endpoint file-write events to identify inbound weaponized .xlsx, .xlsm, or .xls files.
Apply YARA rules for known malicious Excel structures once vendor or community signatures are published.

Monitoring Recommendations

Monitor Microsoft Defender SmartScreen and Mark-of-the-Web (MOTW) events for files opened outside Protected View.
Track Office telemetry for repeated crashes in EXCEL.EXE, which can indicate exploit development or unstable payloads.
Baseline normal Excel network egress and flag deviations from user-populated destinations.

How to Mitigate CVE-2026-65807

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory across all affected Windows and macOS Office builds.
Prioritize patching for users with elevated privileges, finance staff, and executives who routinely receive external spreadsheets.
Verify that Protected View and Office Protected View for files from the internet are enforced through Group Policy.

Patch Information

Microsoft has released patches through the standard Office update channels for Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021, and Office LTSC 2024. Consult the Microsoft Security Update Guide for CVE-2026-65807 for build numbers matching each servicing channel.

Workarounds

Block inbound Excel attachments from untrusted senders at the mail gateway until patches are deployed.
Enforce Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and from injecting into other processes.
Require Protected View for files originating from the internet and from unsafe locations, and disable the ability for users to exit Protected View without administrator approval where practical.
Restrict local administrator rights so that successful exploitation does not immediately yield privileged code execution.

bash

# Configuration example
# Enforce ASR rule: Block all Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Enforce Protected View for files from the internet (registry, per Office version)
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f