Microsoft Office RCE via Preview Pane (CVE-2026-26110, CVE-2026-26113) — March 2026 Patch Tuesday

Microsoft Office RCE via Preview Pane (CVE-2026-26110 (TL-2026-0211), also tracked as March 2026 Patch Tuesday, is a critical-severity software vulnerability scored CVSS 8.4, first published 2026-03-11. It has no confirmed attribution, affects Microsoft Microsoft Office, references 17 CVEs (CVE-2026-26110, CVE-2026-26113, CVE-2026-26144), maps to 17 MITRE ATT&CK techniques (T1005, T1020, T1027), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-0211

Threat ID
TL-2026-0211
Also known as
March 2026 Patch Tuesday, Office Preview Pane RCE
Severity
CRITICAL
CVSS
8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-03-11
Last reviewed
2026-03-11
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
government, financial, healthcare, technology, education, defense, energy, manufacturing, retail, legal
Target regions
Global
Detection rules
9
Indicators of compromise
15

Malware and tooling in Microsoft Office RCE via Preview Pane (CVE-2026-26110

Malware and tooling: Snort rules 66089-66092, 66096-66097, 66101-66104

Two Critical remote code execution vulnerabilities in Microsoft Office (CVE-2026-26110 type confusion, CVE-2026-26113 untrusted pointer dereference) allow attackers to execute arbitrary code via the Preview Pane without requiring users to open malicious documents. March 2026 Patch Tuesday also addresses a Critical zero-click Excel Copilot Agent data exfiltration flaw (CVE-2026-26144), two publicly disclosed zero-days, and six privilege escalation vulnerabilities rated more likely to be exploited.

How Microsoft Office RCE via Preview Pane (CVE-2026-26110 works

Microsoft’s March 2026 Patch Tuesday, released March 11, 2026, addresses 83 vulnerabilities across Windows, Microsoft Office, Azure, SQL Server, .NET, and Chromium-based Edge. Eight vulnerabilities are rated Critical and 75 rated Important. No vulnerabilities were actively exploited at time of release, but two were publicly disclosed zero-days.

The headline threats are CVE-2026-26110 and CVE-2026-26113, both Critical remote code execution vulnerabilities in Microsoft Office exploitable through the Preview Pane. CVE-2026-26110 is a type confusion flaw (CWE-843) caused by access to a resource using an incompatible type, where Office incorrectly handles object types and mistreats a resource as an incompatible type. Attackers craft documents containing malformed objects that cause type confusion, corrupt memory, and enable code execution. CVE-2026-26113 is an untrusted pointer dereference flaw (CWE-822) where Microsoft Office improperly handles memory pointers, allowing manipulation of memory access. Both carry a CVSS score of 8.4 with local attack vector, low complexity, no privileges required, and no user interaction needed. The Preview Pane serves as the attack vector for both, meaning users can be compromised simply by previewing a malicious document in Outlook, Windows Explorer, or other applications that render document previews. Critically, hiding the Preview Pane in Outlook may not fully mitigate these attacks. Zero Day Initiative’s Dustin Childs warns these Preview Pane vulnerabilities continue appearing regularly and “it’s just a matter of time until they start appearing in active exploits.”

CVE-2026-26144 is a Critical information disclosure vulnerability in Microsoft Excel (CVSS 7.5) caused by improper neutralization of input during web page generation (cross-site scripting). What makes this vulnerability exceptional is its ability to weaponize Copilot Agent mode: an attacker can exploit the XSS flaw to cause Copilot Agent to exfiltrate data via unintended network egress, enabling a zero-click information disclosure attack. No user interaction or privileges are needed. This represents an emerging attack pattern where AI assistant features amplify the impact of traditional web vulnerabilities.

Two publicly disclosed zero-days were patched: CVE-2026-21262, an elevation of privilege vulnerability in SQL Server (CVSS 8.8) caused by improper access control that enables attackers to gain SQL sysadmin privileges; and CVE-2026-26127, a denial of service vulnerability in .NET 9.0 and 10.0 (CVSS 7.5) caused by an out-of-bounds read.

Six privilege escalation vulnerabilities were flagged by Microsoft as “more likely to be exploited”: CVE-2026-23668 (Windows Graphics Component), CVE-2026-24289 (Windows Kernel, use-after-free, SYSTEM access), CVE-2026-24291 (Windows Accessibility Infrastructure ATBroker.exe), CVE-2026-24294 (Windows SMB Server), CVE-2026-25187 (Winlogon), and CVE-2026-26132 (Windows Kernel, use-after-free). Additionally, CVE-2026-23669 is a Windows Print Spooler RCE (CVSS 8.8) caused by a use-after-free flaw similar to PrintNightmare, allowing SYSTEM-level code execution.

Other Critical vulnerabilities include CVE-2026-21536 (Devices Pricing Program RCE, CVSS 9.8), CVE-2026-26125 (Payment Orchestrator EoP, CVSS 8.6), CVE-2026-23651 and CVE-2026-26124 (Azure Container Instances Confidential Containers EoP, CVSS 6.7), and CVE-2026-26122 (ACI Confidential Containers Information Disclosure, CVSS 6.5).

---

**Revalidated on 2026-03-12**

One day after initial disclosure, CVE-2026-26110 and CVE-2026-26113 remain unpatched in many environments and have not yet been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No confirmed active exploitation in the wild has been observed as of March 12, 2026. However, the Zero Day Initiative has warned that exploitation 'could happen soon', noting these Preview Pane RCE bugs continue a concerning trend across recent Patch Tuesdays.

Cisco Talos has released Snort detection rules (SIDs 66089-66092, 66096, 66097, 66101-66104; Snort 3: 301442-301446) to detect exploitation attempts targeting these vulnerabilities. There are unverified reports of proof-of-concept exploit code circulating in underground forums, which would significantly accelerate the timeline to active exploitation.

Microsoft recommends the following interim mitigations for organizations unable to patch immediately: (1) disable the Preview Pane in Windows Explorer and Outlook, (2) enable Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting code into other processes, and (3) restrict opening of Office files from untrusted sources.

Additionally, CVE-2026-26144 (the Excel Copilot Agent data exfiltration flaw) has been further characterized by The Register and security researchers as a cross-site scripting (XSS) combined with indirect prompt injection attack chain, where a crafted Excel document can cause Copilot Agent mode to exfiltrate data via unintended network egress in a zero-click scenario -- a novel attack class targeting AI-integrated Office features.

MITRE ATT&CK techniques used in TL-2026-0211

collection

T1005 Data from Local System; T1114 Email Collection

exfiltration

T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service

defense-evasion

T1027 Obfuscated Files or Information; T1211 Exploitation for Stealth

privilege-escalation

T1068 Exploitation for Privilege Escalation

command-and-control

T1071 Application Layer Protocol

discovery

T1082 System Information Discovery

persistence

T1137 Office Application Startup

initial-access

T1190 Exploit Public-Facing Application; T1566 Phishing

execution

T1203 Exploitation for Client Execution; T1204 User Execution

lateral-movement

T1210 Exploitation of Remote Services

credential-access

T1212 Exploitation for Credential Access

impact

T1499 Endpoint Denial of Service

Affected products and versions in Microsoft Office RCE via Preview Pane (CVE-2026-26110

  • Microsoft — Microsoft Office
    Vulnerable versions: Office 2016; Office 2019; Office LTSC 2021; Office LTSC 2024; Microsoft 365 Apps for Enterprise; Office for Android
    Fixed in: Office 2016 (March 2026 update); Office 2019 (March 2026 update); Office LTSC 2021 (March 2026 update); Office LTSC 2024 (March 2026 update); Microsoft 365 Apps (March 2026 update)
  • Microsoft — Microsoft Excel
    Vulnerable versions: Excel (all supported versions with Copilot Agent)
    Fixed in: Excel (March 2026 security update)
  • Microsoft — Microsoft SQL Server
    Vulnerable versions: SQL Server 2016 and later
    Fixed in: SQL Server (March 2026 cumulative update)
  • Microsoft — .NET
    Vulnerable versions: .NET 9.0; .NET 10.0
    Fixed in: .NET 9.0 (March 2026 update); .NET 10.0 (March 2026 update)
  • Microsoft — Windows
    Vulnerable versions: Windows 10; Windows 11; Windows Server 2019; Windows Server 2022
    Fixed in: Windows (March 2026 cumulative updates)

Remediation for Microsoft Office RCE via Preview Pane (CVE-2026-26110

Patches

  • Microsoft March 2026 Patch Tuesday (released 2026-03-11)
  • Apply security updates for Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps
  • Apply SQL Server cumulative updates for CVE-2026-21262
  • Update .NET 9.0 and 10.0 runtimes for CVE-2026-26127
  • Apply Windows cumulative updates for kernel and Print Spooler fixes

Immediate actions

  • Apply March 2026 Patch Tuesday security updates immediately for all affected Microsoft Office products
  • Disable or restrict Preview Pane functionality in Outlook and Windows Explorer where feasible
  • Block Office file types at email gateway for untrusted senders
  • Restrict outbound network traffic from Excel processes to mitigate CVE-2026-26144 Copilot exfiltration
  • Disable Copilot Agent mode in Excel until patches are deployed
  • Monitor for unusual Office process behavior including unexpected child processes and network connections

Workarounds

  • Disable Preview Pane in Outlook (note: may not fully mitigate per Microsoft advisory)
  • Disable Preview Pane in Windows Explorer
  • Block Office file attachments from untrusted external sources at the email gateway
  • Disable Copilot Agent mode in Microsoft Excel
  • Restrict outbound connections from Office applications via host-based firewall rules

Longer-term hardening

  • Deploy EDR with behavioral detection for Office exploitation patterns including type confusion and pointer dereference attacks
  • Implement application control policies restricting code execution from Office processes
  • Establish automated patch management for Microsoft Office with priority SLA for Critical RCE vulnerabilities
  • Deploy network segmentation to limit lateral movement from compromised workstations
  • Implement attack surface reduction (ASR) rules for Office applications
  • Monitor and restrict AI assistant features (Copilot Agent) with data loss prevention controls

CVEs associated with Microsoft Office RCE via Preview Pane (CVE-2026-26110

Weaknesses (CWE) in Microsoft Office RCE via Preview Pane (CVE-2026-26110

CWE-843, CWE-822, CWE-79, CWE-284, CWE-125, CWE-416, CWE-269

Timeline of Microsoft Office RCE via Preview Pane (CVE-2026-26110

  • The Register reports on CVE-2026-26144 Excel Copilot Agent weaponization as zero-click data exfiltration vector
  • Zero Day Initiative publishes March 2026 Security Update Review covering CVE-2026-26110, CVE-2026-26113, CVE-2026-26144
  • Reports emerge of proof-of-concept exploit code for CVE-2026-26110 circulating in underground forums (unverified) [Source: https://windowsnews.ai/article/microsoft-office-critical-patches-cve-2026-26110-and-cve-2026-26113-require-immediate-attention.404710]
  • Multiple security vendors (Qualys, Arctic Wolf, SOCRadar, Malwarebytes) publish advisories urging immediate patching and recommending disabling Preview Pane and enabling ASR rules as interim mitigations [Source: https://blog.qualys.com/vulnerabilities-threat-research/2026/03/10/microsoft-patch-tuesday-march-2026-security-update-review]
  • Zero Day Initiative review warns exploitation of Preview Pane RCE bugs ''could happen soon'', continuing a trend of such vulnerabilities across recent Patch Tuesdays [Source: https://www.zerodayinitiative.com/blog/2026/3/10/the-march-2026-security-update-review]
  • Cisco Talos releases Snort detection rules (SIDs 66089-66092, 66096, 66097, 66101-66104; Snort 3 SIDs 301442-301446) covering CVE-2026-26110 and CVE-2026-26113 exploitation attempts [Source: https://blog.talosintelligence.com/microsoft-patch-tuesday-march-2026/]
  • Cisco Talos releases Snort rules 66089-66092, 66096-66097, 66101-66104 and Snort 3 rules 301442-301446 for March 2026 Patch Tuesday coverage
  • ZDI warns Office Preview Pane RCE vulnerabilities appearing regularly, exploitation in the wild expected imminently
  • Multiple security vendors (Tenable, Qualys, Talos, SANS) publish analysis confirming six EoP vulnerabilities flagged as more likely to be exploited
  • Two publicly disclosed zero-days patched: CVE-2026-21262 (SQL Server EoP, CVSS 8.8) and CVE-2026-26127 (.NET DoS, CVSS 7.5)
  • Microsoft releases March 2026 Patch Tuesday addressing 83 CVEs including 8 Critical across Windows, Office, Azure, SQL Server, .NET
  • CVE-2026-26110 and CVE-2026-26113 confirmed NOT listed in CISA Known Exploited Vulnerabilities (KEV) catalog; no active exploitation in the wild confirmed as of this date [Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog]
  • As of 2026-05-29, TL-2026-0211 (Office Preview Pane RCE CVE-2026-26110/26113, March 2026 Patch Tuesday) stays PATCHED — fixes shipped 2026-03-11 and remain available. No confirmed in-the-wild exploitation, no CISA KEV listing (incl. May 1/20/21 batches), and the bug is unattributed with no campaign or successor.

Sources cited for Microsoft Office RCE via Preview Pane (CVE-2026-26110

Threats related to Microsoft Office RCE via Preview Pane (CVE-2026-26110

Detection coverage for TL-2026-0211

As of 2026-03-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0211 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats