CVE-2026-81387: Microsoft 365 Apps Information Disclosure

CVE-2026-81387 Overview

CVE-2026-81387 is an information disclosure vulnerability in Microsoft Office Excel. The flaw is classified under [CWE-497]: Exposure of Sensitive System Information to an Unauthorized Control Sphere. An unauthorized attacker can disclose sensitive information locally when a user opens a crafted Excel file. Exploitation requires user interaction but no prior authentication. The vulnerability affects multiple supported Microsoft Office releases on both Windows and macOS, including Microsoft 365 Apps, Office 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC.

Critical Impact
Successful exploitation exposes sensitive system information from the target's Excel process, potentially aiding follow-on attacks such as credential theft or privilege escalation.

Affected Products

Microsoft 365 Apps for Enterprise (x86, x64) and Microsoft 365 for macOS
Microsoft Office 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC (x86, x64, macOS where applicable)
Microsoft Excel 2016 (x86, x64)

Discovery Timeline

2026-09-08 - CVE-2026-81387 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81387

Vulnerability Analysis

The vulnerability resides in how Microsoft Excel handles data structures inside spreadsheet files. When Excel parses a maliciously crafted workbook, the application exposes sensitive process or system information to a control sphere that should not have access to it. The attack is local because the malicious file must be delivered to the user and opened in Excel. No elevated privileges are required to trigger the disclosure, but the user must interact with the file. The disclosed information can include memory contents, file paths, or environment data that assist an attacker in reconnaissance or in chaining additional exploits.

Root Cause

The root cause maps to [CWE-497], where Excel places sensitive system information into a location or output channel accessible to code or actors outside the intended trust boundary. Insufficient scrubbing or improper isolation during file parsing allows values that should remain internal to Excel to be observed by the attacker's crafted content.

Attack Vector

An attacker crafts a malicious Excel workbook and delivers it through phishing email, a shared drive, a web download, or a collaboration platform. When the victim opens the file in a vulnerable Excel version, the parsing routine leaks sensitive information that the attacker's payload can extract or exfiltrate. The vector is local and requires user interaction, but the attacker does not need credentials on the target system.

No public proof-of-concept code exists for CVE-2026-81387. Refer to the Microsoft Security Response Center advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-81387

Indicators of Compromise

Unexpected Excel workbooks (.xlsx, .xlsm, .xlsb, .xls) arriving from external senders and being opened by end users.
Excel process (EXCEL.EXE) making unusual outbound network connections shortly after opening an attachment.
Excel spawning child processes or accessing sensitive file paths that fall outside typical spreadsheet workflows.

Detection Strategies

Hunt for Excel processes reading sensitive files (credential stores, configuration files, user profile artifacts) that are unrelated to the opened workbook.
Correlate email gateway telemetry with endpoint file-open events to identify users who received and opened suspicious spreadsheets.
Enable Office telemetry and Attack Surface Reduction (ASR) rule audit logs to identify anomalous Excel behavior.

Monitoring Recommendations

Monitor endpoint EDR telemetry for Excel process memory access anomalies and unexpected file reads under the user profile.
Track patch-level compliance across all Office installations (Click-to-Run and MSI) via configuration management tooling.
Alert on Office documents originating from the Internet zone (Mark-of-the-Web) that trigger macro or external content prompts.

How to Mitigate CVE-2026-81387

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Response Center advisory to all affected Office builds.
Prioritize patching endpoints used by users who routinely handle spreadsheets from external sources.
Enforce Protected View for files originating from the Internet and Outlook attachments across all Office clients.

Patch Information

Microsoft has published a fix through its standard Patch Tuesday update channel. Administrators should consult the Microsoft Security Response Center advisory for the exact build numbers per channel (Current Channel, Monthly Enterprise Channel, Semi-Annual Enterprise Channel, LTSC, and Microsoft 365 for Mac). Click-to-Run installations receive the update automatically once the client checks in; MSI-based Office 2016 and Office 2019 require the corresponding security update package.

Workarounds

Block or quarantine Excel attachments from untrusted senders at the email gateway until patching is complete.
Configure Office File Block policy to prevent opening of legacy Excel formats from untrusted locations.
Deploy Microsoft Defender Attack Surface Reduction rules that restrict Office child-process creation and untrusted content execution.

bash

# Verify Office Click-to-Run build after patching (Windows)
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user
reg query "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /v VersionToReport