CVE-2026-68806: Microsoft 365 Apps RCE Vulnerability

CVE-2026-68806 Overview

CVE-2026-68806 is an out-of-bounds write vulnerability [CWE-787] in Microsoft Office Excel that allows an unauthenticated attacker to execute arbitrary code locally. Exploitation requires user interaction, typically opening a crafted spreadsheet file. The flaw affects multiple Excel and Office product lines across Windows and macOS, including Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC. Successful exploitation leads to code execution in the context of the current user, with high impact on confidentiality, integrity, and availability. Microsoft published the advisory on August 11, 2026 and issued security updates through the Microsoft Security Response Center.

Critical Impact
A crafted Excel file opened by a user can trigger arbitrary code execution on the local system with the user's privileges.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Excel 2016 (x64 and x86)
Microsoft 365 for macOS
Microsoft Office 2019 (x64 and x86)
Microsoft Office 2021 LTSC (Windows and macOS)
Microsoft Office 2024 LTSC (Windows and macOS)

Discovery Timeline

2026-08-11 - CVE-2026-68806 published to NVD and Microsoft security update released
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68806

Vulnerability Analysis

CVE-2026-68806 is an out-of-bounds write flaw in Microsoft Excel's file parsing logic. Excel writes data beyond the bounds of an allocated buffer when processing a specially crafted spreadsheet. The condition maps to [CWE-787], a class of memory corruption regularly abused for arbitrary code execution in Office applications.

Exploitation requires the target user to open a malicious file. Because Excel executes with the user's privileges, successful exploitation grants code execution in that user context. Attackers commonly chain such flaws with phishing to deliver loaders, stealers, or ransomware.

EPSS data as of August 13, 2026 places the exploitation probability at 0.393%. No public proof-of-concept has been observed, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog at the time of writing.

Root Cause

The root cause is improper bounds validation while parsing structured content inside Excel workbook files. Crafted record sizes or field lengths cause Excel to write attacker-controlled data outside the allocated buffer, corrupting adjacent heap or stack memory used for control flow.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a weaponized .xls, .xlsx, or related Excel file through email, web download, shared drive, or collaboration platform. When the victim opens the file, parsing triggers the out-of-bounds write and enables code execution.

No verified public exploit code exists for CVE-2026-68806. See the Microsoft Security Update CVE-2026-68806 advisory for authoritative technical guidance.

Detection Methods for CVE-2026-68806

Indicators of Compromise

Unexpected Excel child processes such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe spawned from EXCEL.EXE.
Excel crashes or WerFault.exe events referencing EXCEL.EXE shortly after opening an attachment.
Excel writing executable content or scripts to %TEMP%, %APPDATA%, or user profile directories.
Outbound network connections initiated by EXCEL.EXE to previously unseen or low-reputation domains.

Detection Strategies

Hunt for process-creation events where the parent image is EXCEL.EXE and the child image is a scripting or living-off-the-land binary.
Monitor file-write events from EXCEL.EXE targeting executable extensions (.exe, .dll, .ps1, .js, .hta, .vbs).
Correlate Office crash telemetry with email delivery of spreadsheet attachments from external senders.
Apply YARA and static analysis to inbound Excel files for malformed record structures consistent with out-of-bounds write triggers.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block child process creation from Office applications.
Forward Sysmon Event IDs 1, 7, and 11 from endpoints running Excel to a centralized SIEM for behavioral analysis.
Track macro and add-in loading events, and alert on unsigned or newly seen add-ins in Office telemetry.
Review email gateway logs for spreadsheet attachments delivered from external or newly registered domains.

How to Mitigate CVE-2026-68806

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-68806 advisory across all affected Excel and Office installations.
Prioritize patching on endpoints belonging to high-risk users such as executives, finance, and HR staff who routinely receive external spreadsheets.
Block or quarantine inbound Excel attachments from untrusted senders at the email gateway until patches are deployed.
Confirm Microsoft 365 Apps update channels are current on both Windows and macOS hosts.

Patch Information

Microsoft released fixes for CVE-2026-68806 on August 11, 2026. Consult the Microsoft Security Update CVE-2026-68806 advisory for the specific build numbers and KB articles applicable to Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC on Windows and macOS.

Workarounds

Enable Protected View and Office Application Guard so untrusted Excel files open in an isolated container.
Configure Group Policy to block macros in files originating from the internet using the Mark-of-the-Web attribute.
Enforce Attack Surface Reduction rules that prevent Office applications from creating child processes and from injecting into other processes.
Restrict end-user execution privileges and remove local administrator rights to limit the impact of successful exploitation.

bash

# Example: enable ASR rule blocking Office child processes (run as admin)
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled