Microsoft 365 vulnerabilities

347 CVEs affecting Microsoft 365, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97780, published 2026-10-13.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-70291, published 2026-10-13. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
• CVE-2026-70281, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.
• CVE-2026-88156, published 2026-10-13. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
• CVE-2026-78509, published 2026-09-08. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
• CVE-2026-70105, published 2026-08-20. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
• CVE-2026-72977, published 2026-09-08. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
• CVE-2026-88178, published 2026-10-13. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
• CVE-2026-80091, published 2026-09-08. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information over a network.
• CVE-2026-80090, published 2026-09-08. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
• CVE-2026-80089, published 2026-09-08. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.

Latest

• CVE-2026-97780, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97779, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
• CVE-2026-97778, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97777, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97776, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97775, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97773, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97772, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97771, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97770, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.