CVE-2026-81394: Microsoft 365 Apps Information Disclosure

CVE-2026-81394 Overview

CVE-2026-81394 is an information disclosure vulnerability in Microsoft Office Excel. The flaw allows an unauthorized attacker to disclose sensitive system information locally when a user opens a crafted document. The issue is tracked under CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere.

The vulnerability affects multiple supported Office builds, including Microsoft 365 Apps, Office 2016, 2019, 2021, and 2024 across Windows and macOS. Exploitation requires user interaction, typically by opening a malicious Excel file delivered via phishing or an untrusted share.

Critical Impact
Successful exploitation exposes sensitive system information from the host running Microsoft Excel, providing attackers with reconnaissance data to enable follow-on attacks.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86) and Microsoft 365 for macOS
Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (Windows x64/x86 and macOS)
Microsoft Excel 2016 (x64 and x86)

Discovery Timeline

2026-09-08 - CVE-2026-81394 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81394

Vulnerability Analysis

CVE-2026-81394 stems from Excel exposing sensitive system information to a control sphere that should not have access to it. When Excel parses a specially crafted workbook, internal data such as memory contents, file paths, or environment attributes can be surfaced to the attacker-controlled document context. The attacker uses this data to profile the victim host and plan additional actions.

Exploitation is local and requires the victim to open the malicious file. No elevated privileges are needed, and the attack does not modify system state or affect availability. The EPSS estimate of 0.393% (percentile 32.717) indicates a low but non-trivial probability of exploitation activity over the next 30 days.

Root Cause

The root cause is classified as [CWE-497], where Excel returns sensitive process or system data to an unauthorized sphere during document parsing. This typically occurs when uninitialized memory, internal object metadata, or host attributes are serialized into structures that the workbook can read back or that leak into rendered content.

Attack Vector

An attacker crafts an Excel workbook that triggers the disclosure path during opening or evaluation. The file is delivered through email, chat, a compromised website, or a shared drive. When the target opens the file in a vulnerable Excel build, sensitive information is surfaced to the attacker through document content, network callbacks, or exfiltrated calculations. No verified proof-of-concept code is publicly available at the time of publication.

Detection Methods for CVE-2026-81394

Indicators of Compromise

Excel processes (EXCEL.EXE) spawning outbound network connections shortly after opening a document from an email attachment or download directory.
Excel workbooks containing external links, remote images, or DDE references pointing to attacker-controlled infrastructure.
Unexpected reads of process memory, environment variables, or system paths reflected in workbook cells or exported content.

Detection Strategies

Hunt for Excel child processes and network activity correlated with the opening of unsigned or externally sourced .xlsx, .xlsm, or .xlsb files.
Inspect email gateways and web proxies for Office documents originating from low-reputation senders or domains.
Apply YARA or content inspection rules that flag workbooks containing suspicious external references, embedded objects, or macros that read environment data.

Monitoring Recommendations

Enable Microsoft Office telemetry and forward Microsoft-Office-Alerts and OAlerts event logs to a centralized log platform.
Monitor DNS and HTTP egress from Office processes for connections to newly registered or uncategorized domains.
Alert on Protected View bypasses and Mark-of-the-Web removal on Office documents.

How to Mitigate CVE-2026-81394

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-81394 Advisory to all affected Office and Microsoft 365 Apps installations.
Prioritize patching endpoints that regularly process external Excel content, such as finance, HR, and executive systems.
Verify Microsoft 365 Apps update channels are current and that macOS Office builds have received the corresponding update.

Patch Information

Microsoft has published the fix through the Microsoft Security Response Center advisory for CVE-2026-81394. Deploy the update via Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or the Microsoft 365 Apps admin center. On macOS, install the update through Microsoft AutoUpdate.

Workarounds

Enforce Protected View and Block Macros From Running In Office Files From The Internet via Group Policy until patching is complete.
Use Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and from making network calls where not required.
Restrict inbound Excel file types at the email gateway and require sandbox detonation for attachments from external senders.

bash

# Enable Block macros from running in Office files from the Internet (Excel)
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f

# Enforce Protected View for files originating from the Internet
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f