CVE-2024-38189: Microsoft Project Remote Code Execution Vulnerability

High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2024-08-13. EPSS: 8.2% chance of exploitation in the next 30 days.

Microsoft Project Remote Code Execution Vulnerability

Affected products

• Microsoft 365 Apps: affected versions not specified
• Microsoft Office 2019: affected versions not specified
• Microsoft Office Long Term Servicing Channel: version 2021 only
• Microsoft Project 2016: before 16.0.5461.1001 (fixed in 16.0.5461.1001)

Published 2024-08-13. Last modified 2026-06-17.