CVE-2026-81394

MediumCVSS 5.5/10Last modified Sep 17, 2026

Description

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-497

Affected software

Vendor	Product	Versions
Microsoft	Microsoft 365 Apps for Enterprise	>= 16.0.1, < 16.0.20326.20138
Microsoft	Microsoft Excel 2016	>= 16.0.0.0, < 16.0.5569.1003
Microsoft	Microsoft Office 2016	>= 16.0.0, < 16.0.5569.1003
Microsoft	Microsoft Office 2019	>= 19.0.0, < 16.0.10417.20207
Microsoft	Microsoft Office 365 for Mac	>= 1.0.0, < 16.113.26091433
Microsoft	Microsoft Office LTSC 2021	>= 16.0.1, < 16.0.14334.20906
Microsoft	Microsoft Office LTSC 2024	>= 16.0.0, < 16.0.17932.20976
Microsoft	Microsoft Office LTSC for Mac 2021	>= 16.0.1, < 16.113.26091433
Microsoft	Microsoft Office LTSC for Mac 2024	>= 16.0.0, < 16.113.26091433

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81394Patch, Vendor Advisory

Timeline

Published: Sep 8, 2026
Last modified: Sep 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-813955.5Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2026-813967.8Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-813977.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-813987.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-813995.5Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2026-81406.5Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/<remoteId>. The CVE-2026-814005.5Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2026-814015.5Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to disclose informat CVE-2026-814029.8The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its ima CVE-2026-814047.1The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, CVE-2026-81417.2The Ajax Load More - Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'taxonomy_include_children' parameter CVE-2026-81426.5VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address fo