Microsoft 365 Apps vulnerabilities

905 CVEs affecting Microsoft 365 Apps, 10 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97781, published 2026-10-13.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-23397: Microsoft Office Outlook Privilege Escalation Vulnerability, published 2023-03-14. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-03-14. EPSS: 97.2% chance of exploitation in the next 30 days. Microsoft Outlook Elevation of Privilege Vulnerability
• CVE-2024-21413: Microsoft Outlook Improper Input Validation Vulnerability, published 2024-02-13. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2025-02-06. EPSS: 94.7% chance of exploitation in the next 30 days. Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability, published 2026-01-26. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-01-26. EPSS: 70.8% chance of exploitation in the next 30 days. Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
• CVE-2021-42292: Microsoft Excel Security Feature Bypass, published 2021-11-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-17. EPSS: 43% chance of exploitation in the next 30 days. Microsoft Excel Security Feature Bypass Vulnerability
• CVE-2023-36761: Microsoft Word Information Disclosure Vulnerability, published 2023-09-12. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2023-09-12. EPSS: 19.6% chance of exploitation in the next 30 days. Microsoft Word Information Disclosure Vulnerability
• CVE-2023-35311: Microsoft Outlook Security Feature Bypass Vulnerability, published 2023-07-11. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2023-07-11. EPSS: 15.5% chance of exploitation in the next 30 days. Microsoft Outlook Security Feature Bypass Vulnerability
• CVE-2023-21715: Microsoft Office Publisher Security Feature Bypass Vulnerability, published 2023-02-14. High severity, CVSS 7.3. Actively exploited: in CISA KEV since 2023-02-14. EPSS: 12% chance of exploitation in the next 30 days. Microsoft Publisher Security Feature Bypass Vulnerability
• CVE-2024-38189: Microsoft Project Remote Code Execution Vulnerability, published 2024-08-13. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2024-08-13. EPSS: 8.2% chance of exploitation in the next 30 days. Microsoft Project Remote Code Execution Vulnerability
• CVE-2021-38646: Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability, published 2021-09-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 8% chance of exploitation in the next 30 days. Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
• CVE-2026-21514: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability, published 2026-02-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-02-10. EPSS: 1.6% chance of exploitation in the next 30 days. Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.

Latest

• CVE-2026-97781, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
• CVE-2026-97780, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97779, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
• CVE-2026-97778, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97777, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97776, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97775, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97774, published 2026-10-13. High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days. Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
• CVE-2026-97773, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97772, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.