Microsoft Excel Security Feature Bypass
Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An unauthenticated attacker, with local access to the host, if a user is tricked into opening a malicious file or link, can fully compromise the system — steal data, tamper with it and take it offline.
Microsoft Excel Security Feature Bypass Vulnerability
Inferred from the weakness type (CWE) and how the flaw is reached — the techniques an attacker would chain to exploit this. Real-world corroboration appears here as threat intel is folded in.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Named threat actors and observed ATT&CK techniques appear here as intel feeds are folded in — the ATT&CK chain above stays inferred until then.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
Implement robust email and web filtering to block untrusted Office documents, and configure GPOs to prevent macros from running in Excel files originating from the internet. Educate users about the risks of opening unsolicited attachments and enforce strong application control policies to restrict unauthorized execution of scripts and executables.
Apply the official security updates released by Microsoft for all affected versions of Microsoft Excel and Office. Ensure all endpoints have the latest security patches installed to fully remediate this security feature bypass vulnerability.
An attacker can bypass Excel's security policies, specifically the Mark-of-the-Web protection, allowing malicious VBA macros to execute without user warnings or prompts. This enables the attacker to achieve arbitrary code execution on the victim's system, leading to data theft, system compromise, or further malware deployment, posing significant business and reputational risks.
No CWE classification has been assigned.
Other CVEs affecting 365 apps
Microsoft Outlook Remote Code Execution Vulnerability
Microsoft Outlook Elevation of Privilege Vulnerability
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.
A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".
Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."