Microsoft released fixes for more than 30 newly disclosed vulnerabilities, most of them in Microsoft Office, including two dozen high-severity flaws that could let attackers run malicious code through crafted files. SecurityWeek says Word accounts for most of the bugs, with additional fixes for Excel, Outlook, PowerPoint, and SharePoint; about six of the remote code execution issues could be triggered via Outlook's Preview Pane. Microsoft also patched Office information-disclosure bugs, a security bypass issue, an ASP.NET Core denial-of-service flaw, an Identity Web elevation-of-privilege bug, and an MSAL for Node.js information-disclosure issue.
Why it matters: Office is one of the most widely used attack surfaces for phishing and document-based malware, so these fixes matter even though Microsoft says no zero-day exploitation is known yet. Organizations and users should apply the updates quickly, especially where Office documents are opened from email or where Outlook Preview Pane is enabled.
Ionut Arghire
2026.10.16
100% relevant
This article establishes a distinct Microsoft post-Patch-Tuesday Office patch event focused on newly released fixes for a large set of Office remote code execution flaws, not the already tracked broader Patch Tuesday story.
← Back to all stories