‹ Back to list

CVE-2026-118723

High (7.8)—
Schedule the patchSeverity High 7.8. No public exploit or active exploitation known.
Vendor advisory· Microsoft MSRC
Severity7.8High · CVSS 3.1
Exploitation probability0.54 %higher than 46% of CVEs · score from Nov 11, 2026
Active exploitationNonot in the CISA catalog · checked Nov 12, 03:00 AM
Public exploitNot knownno public code found

News and reports on Orbitaley

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Timeline

Built from our own data: NVD, CISA KEV and other exploitation catalogues, FIRST EPSS, public exploits, specialised media and Orbitaley coverage.

  1. CVE record published in NVD
  2. Alert: Microsoft fixes 200 vulnerabilities, including an Outlook flaw CISA confirms is being exploited

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

El vector CVSS indica AV:L y UI:R, por lo que se usa T1203; la descripción dice que permite ejecutar código localmente, sin nombrar un intérprete concreto.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Restrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationExecution PreventionBehavior Prevention on EndpointDisable or Remove Feature or Program

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Microsoft — ExcelAI

NVD record

NVD status
Undergoing Analysis
Published
Nov 10, 2026
Last modified
Nov 10, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-822

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-118723",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-118723",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-11-10T19:32:04.971322Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secure@microsoft.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Microsoft 365 Apps for Enterprise",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.1",
              "lessThan": "https://aka.ms/OfficeSecurityReleases",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Office 365 for Mac",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "16.115.26110837",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Office LTSC 2021",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.1",
              "lessThan": "16.0.14334.21048",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Office LTSC 2024",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.0",
              "lessThan": "16.0.17932.21140",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Office LTSC for Mac 2021",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.1",
              "lessThan": "16.115.26110837",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Office LTSC for Mac 2024",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.0",
              "lessThan": "16.115.26110837",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Office Online Server",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.0.0",
              "lessThan": "16.0.10417.20236",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-11-10T19:19:48.420",
  "references": [
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118723",
      "source": "secure@microsoft.com"
    }
  ],
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secure@microsoft.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-822"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally."
    }
  ],
  "lastModified": "2026-11-10T20:18:23.330",
  "sourceIdentifier": "secure@microsoft.com"
}