Threat reportVulnerabilityTL-2026-1827
GovCERT.HK Security Alert A26-08-01: Multiple Vulnerabilities in Microsoft Edge, Office 2019/LTSC 2021/LTSC 2024, Excel 2016, and Microsoft 365 Apps for Enterprise
GovCERT.HK Security Alert A26-08-01 (TL-2026-1827), also tracked as GovCERT.HK A26-08-01, is a medium-severity software vulnerability, first published 2026-08-03. It has no confirmed attribution, affects Microsoft Microsoft Edge, references 7 CVEs (CVE-2026-17650 - CVE-2026-18019, CVE-2026-62870, CVE-2026-65802), maps to 13 MITRE ATT&CK techniques (T1005, T1036, T1068), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 7Referenced vulnerabilities
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-1827
- Threat ID
- TL-2026-1827
- Also known as
- GovCERT.HK A26-08-01
- Severity
- MEDIUM
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, all-industries
- Target regions
- hong kong, Global
- Detection rules
- 9
- Indicators of compromise
- 29
How GovCERT.HK Security Alert A26-08-01 works
GovCERT.HK published Security Alert A26-08-01 on 3 August 2026, bundling a Chromium-derived Microsoft Edge CVE range (CVE-2026-17650 through CVE-2026-18019) with a set of named Microsoft Office/Excel/365 Apps CVEs. Successful exploitation could lead to remote code execution, denial of service, information disclosure, security restriction bypass, spoofing, or tampering. Vendor patches are already distributed via Windows Update / Microsoft Update Catalog and no active exploitation or public PoC is stated by the source.
On 3 August 2026, the Hong Kong Government Computer Emergency Response Team (GovCERT.HK) issued Security Alert A26-08-01, a routine patch-cycle bundle covering multiple Microsoft client products. The advisory groups vulnerabilities across two product families with different disclosure maturity: (1) Microsoft Edge prior to Stable Channel version 151.0.4129.59, where GovCERT.HK cites the block CVE-2026-17650 through CVE-2026-18019 — a Chromium-inherited numbering range that Microsoft's own Edge Security Release Notes had, as of the 31 July 2026 Stable release, not yet individually itemized ('CVE's will be added as soon as available'); and (2) Microsoft Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft Excel 2016, and Microsoft 365 Apps for Enterprise, covered by named CVEs CVE-2026-62870, CVE-2026-65802, CVE-2026-65804, CVE-2026-66311 through CVE-2026-66318, CVE-2026-66321, CVE-2026-66322, CVE-2026-66325, and CVE-2026-66326.
GovCERT.HK states exploitation could result in remote code execution, denial of service, information disclosure, security restriction bypass, spoofing, or tampering, without differentiating impact by individual CVE. The alert carries GovCERT.HK's standard 'Security Alert' classification rather than its elevated 'High Threat Security Alert' tier, and does not assert active exploitation, a public proof-of-concept, or CISA KEV listing. Direct NVD REST API queries during this research for CVE-2026-62870 and CVE-2026-66311 both returned zero results (empty `vulnerabilities` array), independently confirming these identifiers are reserved but not yet populated with descriptions or CVSS scores in the public record — consistent with GovCERT.HK naming them ahead of upstream vendor/NVD detail. None of the named Office/Excel CVEs appear in Microsoft's July 14, 2026 monthly Office/365 Apps security-update release (Current Channel Build 20131.20154, nor the perpetual-channel KB5002886/KB5002887 Excel/Office 2016 updates), indicating this is either an out-of-cycle Current Channel update or a set of very recently reserved/disclosed identifiers. The Edge-side CVE-2026-17650–18019 range aligns with Edge's inheritance of upstream Chromium/Chrome security fixes: Google shipped Chrome Stable security updates on 2026-07-16 (3 Critical-rated flaws) and 2026-07-21 (12 vulnerabilities across WebAudio, ANGLE, V8, Skia, Extensions, Chromecast, certificate handling, GPU, and UI) in the weeks immediately preceding Edge 151.0.4129.59's 2026-07-31 release, the normal cadence by which Chromium CVEs are re-numbered into Microsoft's own range before being individually detailed. Separately, Microsoft's July 14, 2026 Patch Tuesday was independently reported as a record-breaking cycle (570-621 CVEs, ~60-63 rated Critical, including two actively-exploited zero-days and numerous Excel RCE fixes) — none of which correspond to the CVE numbers in this bundle, but which establishes the unusually high patch volume backdrop against which A26-08-01 was issued. Remediation is straightforward: apply the Edge Stable update (151.0.4129.59 or later) and the corresponding Office/365 Apps security updates via Windows Update or the Microsoft Update Catalog.
MITRE ATT&CK techniques used in TL-2026-1827
Collection
Defense Evasion
T1036 Masquerading; T1211 Exploitation for Stealth
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Discovery
T1082 System Information Discovery; T1217 Browser Information Discovery
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
Execution
T1203 Exploitation for Client Execution; T1204 User Execution
Impact
T1499 Endpoint Denial of Service; T1565 Data Manipulation
Credential Access
Affected products and versions in GovCERT.HK Security Alert A26-08-01
- Microsoft — Microsoft Edge
Vulnerable versions: prior to 151.0.4129.59
Fixed in: 151.0.4129.59 (Stable Channel, released 2026-07-31) - Microsoft — Microsoft Office 2019
Vulnerable versions: versions prior to the security update referenced in GovCERT.HK A26-08-01
Fixed in: patched via Windows Update / Microsoft Update Catalog per vendor guidance - Microsoft — Microsoft Office LTSC 2021
Vulnerable versions: versions prior to the security update referenced in GovCERT.HK A26-08-01
Fixed in: patched via Windows Update / Microsoft Update Catalog per vendor guidance - Microsoft — Microsoft Office LTSC 2024
Vulnerable versions: versions prior to the security update referenced in GovCERT.HK A26-08-01
Fixed in: patched via Windows Update / Microsoft Update Catalog per vendor guidance - Microsoft — Microsoft Excel 2016
Vulnerable versions: versions prior to the security update referenced in GovCERT.HK A26-08-01
Fixed in: patched via Windows Update / Microsoft Update Catalog per vendor guidance - Microsoft — Microsoft 365 Apps for Enterprise
Vulnerable versions: versions prior to the security update referenced in GovCERT.HK A26-08-01
Fixed in: patched via Windows Update / Microsoft Update Catalog per vendor guidance
Remediation for GovCERT.HK Security Alert A26-08-01
Patches
- Microsoft Edge Stable 151.0.4129.59 (released 2026-07-31)
- Microsoft Office 2019 / Office LTSC 2021 / Office LTSC 2024 / Excel 2016 / Microsoft 365 Apps for Enterprise security updates distributed via Windows Update / Microsoft Update Catalog per GovCERT.HK A26-08-01
Immediate actions
- Apply the Microsoft Edge Stable Channel update to version 151.0.4129.59 or later via Windows Update / Microsoft Update Catalog
- Apply the corresponding Microsoft Office 2019 / Office LTSC 2021 / Office LTSC 2024 / Excel 2016 / Microsoft 365 Apps for Enterprise security updates referenced in GovCERT.HK A26-08-01 via Windows Update / Microsoft Update Catalog
Workarounds
- None published by GovCERT.HK, HKCERT, or Microsoft for this bundle; vendor patching is the stated remediation path
Longer-term hardening
- Enable automatic updates for Microsoft Edge and Microsoft 365 Apps to reduce the exposure window between vendor patch release and deployment
- Maintain an asset inventory tracking installed Edge/Office/Excel build and version numbers to verify patch compliance across the estate
- Monitor the MSRC Update Guide and NVD for the individual CVE detail Microsoft has indicated is pending for the CVE-2026-17650 through CVE-2026-18019 Edge range
- Track upstream Chromium/Chrome security release notes as a leading indicator of forthcoming Edge CVE detail, given Edge's inheritance of Chromium's CVE numbering
CVEs associated with GovCERT.HK Security Alert A26-08-01
CVE-2026-17650 - CVE-2026-18019, CVE-2026-62870, CVE-2026-65802, CVE-2026-65804, CVE-2026-66311 - CVE-2026-66318, CVE-2026-66321 - CVE-2026-66322, CVE-2026-66325 - CVE-2026-66326
Timeline of GovCERT.HK Security Alert A26-08-01
- Microsoft's prior monthly Office/365 Apps security release (Current Channel 2606, Build 20131.20154) shipped, alongside perpetual-channel KB5002886 (Excel 2016) and KB5002887 (Office 2016); none of the CVEs later bundled in A26-08-01 appear in these releases' published CVE lists.
- Microsoft's July 2026 Patch Tuesday shipped independently of A26-08-01: reported as a record 570-621 CVEs (~60-63 rated Critical), including two actively-exploited zero-days (CVE-2026-56155 ADFS EoP, CVE-2026-56164 SharePoint EoP) and numerous Excel RCE fixes (CVSS 7.8) — none matching the CVE-2026-62870/65802/65804/66311-66326 set later bundled in A26-08-01, confirming the A26-08-01 Office/Excel CVEs are a distinct, more recent update.
- Google shipped Chrome Stable 150.0.7871.128/.129, fixing 7 vulnerabilities (3 rated Critical: CVE-2026-15899 CameraCapture, CVE-2026-15900 GPU, CVE-2026-15901 Network) — part of the upstream Chromium security cadence that Microsoft Edge inherits and re-numbers into its own CVE range.
- Google shipped a further Chrome Stable security update (150.0.7871.181/.182) fixing 12 vulnerabilities across WebAudio, ANGLE, V8, Skia, Extensions, Chromecast, certificate handling, GPU, and UI components — additional upstream Chromium fixes immediately ahead of Edge's July 31 Stable build.
- CISA Known Exploited Vulnerabilities catalog snapshot (1,656 entries) checked during RESEARCH; none of the A26-08-01 CVEs are present.
- Microsoft released Edge Stable Channel version 151.0.4129.59, incorporating the latest Chromium security fixes; Microsoft's own release notes stated individual CVE IDs would be added once available.
- TL-Intel Harness HUNT phase ingested and verified GovCERT.HK A26-08-01 (fetched twice, consistent), flagging it as a weak-fit routine patch-cycle bundle pending RESEARCH-phase CVSS enrichment.
- RESEARCH-phase NVD REST API queries for CVE-2026-62870 and CVE-2026-66311 both returned zero results (empty vulnerabilities array), independently confirming the bundle's individual CVE detail is still pending publication.
- HKCERT mirrored the alert as security bulletin 'Microsoft Edge Multiple Vulnerabilities'.
- GovCERT.HK published Security Alert A26-08-01 covering the bundled Edge/Office/Excel/365 Apps CVE set.
Sources cited for GovCERT.HK Security Alert A26-08-01
- GovCERT.HK Security Alert (A26-08-01): Multiple Vulnerabilities in Microsoft Products
- HKCERT Security Bulletin: Microsoft Edge Multiple Vulnerabilities
- Microsoft Edge release notes for Stable Channel
- Release notes for Microsoft Edge Security Updates
- Release notes for Microsoft Office security updates (Microsoft 365 Apps)
- CISA Known Exploited Vulnerabilities Catalog (checked for A26-08-01 CVE bundle, none listed)
- Microsoft Patches a Record 570 Security Flaws (July 2026 Patch Tuesday)
- Zero Day Initiative — The July 2026 Security Update Review
- Chrome Security Update Fixes 3 Critical Use-After-Free Bugs (CVE-2026-15899)
- Google Chrome Stable Update Patches 12 High-Severity Browser Flaws
Detection coverage for TL-2026-1827
As of 2026-08-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1827 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.