Microsoft Office 365 vulnerabilities

6 CVEs affecting Microsoft Office 365, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-55054, published 2026-07-14.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-8597, published 2018-12-12. High severity, CVSS 7.8. EPSS: 16.1% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This…
• CVE-2019-0945, published 2019-05-16. High severity, CVSS 7.8. EPSS: 13.7% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code…
• CVE-2019-1446, published 2019-11-12. Medium severity, CVSS 5.5. EPSS: 8.9% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'.
• CVE-2019-1109, published 2019-07-15. Critical severity, CVSS 9.1. EPSS: 4.2% chance of exploitation in the next 30 days. A spoofing vulnerability exists when Microsoft Office Javascript does not check the validity of the web page making a request to Office documents.An attacker who successfully exploited this…
• CVE-2019-1402, published 2019-11-12. Medium severity, CVSS 5.5. EPSS: 2.4% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka 'Microsoft Office Information Disclosure Vulnerability'.
• CVE-2026-55054, published 2026-07-14. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.