CVE-2026-81385: Microsoft 365 Apps RCE Vulnerability

CVE-2026-81385 Overview

CVE-2026-81385 is a deserialization of untrusted data vulnerability [CWE-502] in Microsoft Office Publisher. An unauthenticated attacker can execute arbitrary code on a target system by convincing a user to open a crafted Publisher document. The flaw affects multiple Office product lines, including Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Publisher 2016. Successful exploitation grants the attacker code execution in the context of the current user, enabling data theft, lateral movement, or malware deployment.

Critical Impact
Attackers can achieve remote code execution across most currently supported Microsoft Office installations by delivering a malicious Publisher file to a user who opens it.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office 2019, Office 2021 LTSC, Office 2024 LTSC (x64 and x86)
Microsoft Publisher 2016 (x64 and x86)

Discovery Timeline

2026-09-08 - CVE-2026-81385 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81385

Vulnerability Analysis

The vulnerability resides in how Microsoft Office Publisher deserializes data embedded in Publisher documents. When Publisher parses a crafted file, the deserialization routine reconstructs object instances from attacker-controlled input without sufficient validation of type or content. This gives the attacker control over object state and, ultimately, execution flow within the Office process.

Exploitation requires user interaction: the target must open the malicious file. Once opened, the payload executes with the privileges of the current user. Because the attack vector is network-based, adversaries typically deliver the file through phishing email, malicious URLs, or shared file services.

The scope of affected products is broad because the Publisher component is included in Microsoft 365 Apps and the Office LTSC editions, not only standalone Publisher 2016. Any environment where users can open Publisher files inherits the risk.

Root Cause

The root cause is insecure deserialization of untrusted data [CWE-502]. Publisher accepts serialized object data from a document and instantiates objects without enforcing an allow-list of expected types or validating input integrity. This allows a crafted document to force instantiation of gadget chains that lead to arbitrary code execution.

Attack Vector

An attacker crafts a malicious Publisher document (.pub) containing serialized data designed to trigger the vulnerable deserialization path. The attacker delivers the file to a target through phishing, a compromised website, or a file-sharing platform. When the user opens the document, Publisher deserializes the payload and executes attacker-controlled code in the user's security context.

No authentication is required on the attacker's side, and no elevated privileges are needed on the target. The vulnerability is not publicly reported as exploited in the wild at the time of publication.

Detection Methods for CVE-2026-81385

Indicators of Compromise

Publisher documents (.pub, or files masquerading as .pub) received from external senders and opened by end users.
Child processes spawned by mspub.exe or Office host processes, particularly script interpreters (powershell.exe, cmd.exe, wscript.exe) or rundll32.exe.
Unexpected outbound network connections initiated by mspub.exe shortly after a document is opened.
New persistence entries (Run keys, scheduled tasks, or startup folder items) created during or after a Publisher session.

Detection Strategies

Hunt for anomalous parent-child process relationships where mspub.exe spawns interpreters, LOLBins, or unsigned binaries.
Correlate email delivery telemetry with subsequent Publisher document execution to identify phishing-delivered payloads.
Inspect Office telemetry for crash or exception events in mspub.exe that may indicate exploitation attempts.

Monitoring Recommendations

Enable and forward Microsoft Defender or equivalent EDR telemetry for all Office processes to a centralized SIEM.
Alert on execution of Publisher documents originating from email attachments or internet-zone locations.
Monitor for creation of executable files or scripts in user-writable paths during Office sessions.

How to Mitigate CVE-2026-81385

Immediate Actions Required

Apply the security update referenced in the Microsoft CVE-2026-81385 Update Guide to all affected Office installations.
Prioritize patching for users who routinely handle externally sourced documents, such as marketing, sales, and executive assistants.
Reinforce user awareness about opening Publisher files from untrusted senders.

Patch Information

Microsoft has published guidance and updates for this vulnerability. Refer to the Microsoft Security Response Center advisory for CVE-2026-81385 for product-specific update packages covering Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Publisher 2016.

Workarounds

Block .pub file attachments at the email gateway if Publisher is not a business requirement.
Configure Microsoft Office File Block policy via Group Policy to prevent Publisher from opening files from the internet zone.
Enforce Protected View for all documents originating from external locations.
Remove or disable Publisher on endpoints where it is not required for business operations.

bash

# Example Group Policy registry key to block Publisher files from the internet zone
# Applies to Microsoft Publisher File Block settings
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Publisher\Security\FileBlock" /v PubFiles /t REG_DWORD /d 2 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Publisher\Security\FileBlock" /v OpenInProtectedView /t REG_DWORD /d 1 /f