CVE-2026-68810: Microsoft 365 Apps RCE Vulnerability

CVE-2026-68810 Overview

CVE-2026-68810 is an untrusted pointer dereference vulnerability [CWE-822] in Microsoft Office Excel. The flaw allows an unauthorized attacker to execute code locally after a user opens a specially crafted Excel document. Exploitation requires user interaction, but no prior authentication is needed. Successful exploitation grants the attacker the ability to run arbitrary code in the context of the current user, impacting confidentiality, integrity, and availability. The vulnerability affects multiple Microsoft Office product families, including Microsoft 365 Apps, Excel 2016, Office 2019, Office 2021, and Office 2024 across Windows and macOS platforms.

Critical Impact
An attacker can achieve local code execution in the context of the Excel process by convincing a user to open a malicious workbook, enabling malware delivery, credential theft, or lateral movement.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86)
Microsoft Excel 2016 (x64 and x86)
Microsoft 365 (macOS)
Microsoft Office 2019 (x64 and x86)
Microsoft Office 2021 LTSC (x64, x86, macOS)
Microsoft Office 2024 LTSC (x64, x86, macOS)

Discovery Timeline

2026-08-11 - CVE-2026-68810 published to the National Vulnerability Database (NVD)
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68810

Vulnerability Analysis

The vulnerability is classified as an untrusted pointer dereference [CWE-822]. Excel obtains a pointer value from a source under attacker influence and dereferences it without validating that it points to memory the application controls. When the crafted document is parsed, Excel follows the attacker-supplied pointer into an unintended memory region. The result is memory corruption that an attacker can shape into arbitrary code execution within the Excel process. Because Excel runs with the privileges of the invoking user, code execution occurs in the user's security context. The impact scope remains unchanged, meaning the attacker gains no automatic privilege elevation, but full compromise of user-owned data and processes is possible.

Root Cause

The root cause is Excel's failure to validate a pointer value derived from parsed workbook content before dereferencing it. Attacker-controlled bytes within a structured Excel file are interpreted as an in-memory pointer, allowing the attacker to redirect execution or reads and writes to a chosen address. See the Microsoft Security Response Center advisory for vendor-provided technical context.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a malicious .xlsx, .xls, .xlsm, or related Excel file via email attachment, phishing link, file share, or download. When the target opens the workbook, Excel processes the malformed structure and reaches the vulnerable dereference path. No network access to the target is required. Microsoft has not reported public exploitation, and the vulnerability is not on the CISA Known Exploited Vulnerabilities catalog. The EPSS score at publication is 0.303%.

No verified proof-of-concept code is publicly available. Technical exploitation details are described in prose only; refer to the Microsoft advisory for further guidance.

Detection Methods for CVE-2026-68810

Indicators of Compromise

Unexpected child processes spawned by EXCEL.EXE, such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Excel process crashes followed by execution of newly written binaries in user-writable directories like %APPDATA%, %TEMP%, or ~/Library/.
Outbound network connections initiated by EXCEL.EXE to previously unseen domains or IPs shortly after a document is opened.
Creation of persistence artifacts (Run keys, scheduled tasks, LaunchAgents) within seconds of Excel opening an untrusted workbook.

Detection Strategies

Hunt for process lineage where Office applications parent script interpreters or living-off-the-land binaries.
Monitor for anomalous memory allocations, WerFault crashes, or exception events tied to EXCEL.EXE correlated with document opens.
Inspect inbound email attachments and cloud storage uploads for Excel files with malformed OLE structures or unusual embedded objects.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes.
Forward endpoint process, file, and network telemetry to a centralized SIEM or data lake for correlation across Excel-related activity.
Track user-reported Excel crashes and correlate with EDR telemetry to surface early exploitation attempts.

How to Mitigate CVE-2026-68810

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-68810 across all affected Office installations.
Prioritize patching for users who routinely handle external Excel files, including finance, HR, and executive assistants.
Enforce Protected View and Mark-of-the-Web on files received from email and internet sources.
Restrict macro execution and block Office child process creation using Attack Surface Reduction rules.

Patch Information

Microsoft has issued security updates for the affected products through its standard update channels. Administrators should deploy the fixes via Microsoft Update, Microsoft 365 Apps update rings, WSUS, Intune, or SCCM. Consult the Microsoft CVE-2026-68810 Update for the current list of KB articles and build numbers for each channel.

Workarounds

Open untrusted Excel files only in Protected View and disable editing until the source is verified.
Use file inspection gateways to strip or quarantine Excel attachments from unverified senders.
Deploy AppLocker or Windows Defender Application Control policies to prevent Office from launching script hosts and shell binaries.

bash

# Example: enable ASR rule to block Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled