Microsoft Officeplus vulnerabilities

2 CVEs affecting Microsoft Officeplus, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-55243, published 2025-09-09.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-55243, published 2025-09-09. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network.
• CVE-2024-38084, published 2024-08-13. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. Microsoft OfficePlus Elevation of Privilege Vulnerability