# GovCERT.HK Security Alert A26-08-01: Multiple Vulnerabilities in Microsoft Edge, Office 2019/LTSC 2021/LTSC 2024, Excel 2016, and Microsoft 365 Apps for Enterprise

> GovCERT.HK published Security Alert A26-08-01 on 3 August 2026, bundling a Chromium-derived Microsoft Edge CVE range (CVE-2026-17650 through CVE-2026-18019) with a set of named Microsoft Office/Excel/365 Apps CVEs. Successful exploitation could lead to remote code execution, denial of service, information disclosure, security restriction bypass, spoofing, or tampering. Vendor patches are already distributed via Windows Update / Microsoft Update Catalog and no active exploitation or public PoC is stated by the source.

- **Published:** 2026-08-03T00:00:00Z
- **Last reviewed:** 2026-08-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1827
- **ID:** TL-2026-1827
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-17650 - CVE-2026-18019, CVE-2026-62870, CVE-2026-65802, CVE-2026-65804, CVE-2026-66311 - CVE-2026-66318, CVE-2026-66321 - CVE-2026-66322, CVE-2026-66325 - CVE-2026-66326

## Description

On 3 August 2026, the Hong Kong Government Computer Emergency Response Team (GovCERT.HK) issued Security Alert A26-08-01, a routine patch-cycle bundle covering multiple Microsoft client products. The advisory groups vulnerabilities across two product families with different disclosure maturity: (1) Microsoft Edge prior to Stable Channel version 151.0.4129.59, where GovCERT.HK cites the block CVE-2026-17650 through CVE-2026-18019 — a Chromium-inherited numbering range that Microsoft's own Edge Security Release Notes had, as of the 31 July 2026 Stable release, not yet individually itemized ('CVE's will be added as soon as available'); and (2) Microsoft Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft Excel 2016, and Microsoft 365 Apps for Enterprise, covered by named CVEs CVE-2026-62870, CVE-2026-65802, CVE-2026-65804, CVE-2026-66311 through CVE-2026-66318, CVE-2026-66321, CVE-2026-66322, CVE-2026-66325, and CVE-2026-66326.

GovCERT.HK states exploitation could result in remote code execution, denial of service, information disclosure, security restriction bypass, spoofing, or tampering, without differentiating impact by individual CVE. The alert carries GovCERT.HK's standard 'Security Alert' classification rather than its elevated 'High Threat Security Alert' tier, and does not assert active exploitation, a public proof-of-concept, or CISA KEV listing. Direct NVD REST API queries during this research for CVE-2026-62870 and CVE-2026-66311 both returned zero results (empty `vulnerabilities` array), independently confirming these identifiers are reserved but not yet populated with descriptions or CVSS scores in the public record — consistent with GovCERT.HK naming them ahead of upstream vendor/NVD detail. None of the named Office/Excel CVEs appear in Microsoft's July 14, 2026 monthly Office/365 Apps security-update release (Current Channel Build 20131.20154, nor the perpetual-channel KB5002886/KB5002887 Excel/Office 2016 updates), indicating this is either an out-of-cycle Current Channel update or a set of very recently reserved/disclosed identifiers. The Edge-side CVE-2026-17650–18019 range aligns with Edge's inheritance of upstream Chromium/Chrome security fixes: Google shipped Chrome Stable security updates on 2026-07-16 (3 Critical-rated flaws) and 2026-07-21 (12 vulnerabilities across WebAudio, ANGLE, V8, Skia, Extensions, Chromecast, certificate handling, GPU, and UI) in the weeks immediately preceding Edge 151.0.4129.59's 2026-07-31 release, the normal cadence by which Chromium CVEs are re-numbered into Microsoft's own range before being individually detailed. Separately, Microsoft's July 14, 2026 Patch Tuesday was independently reported as a record-breaking cycle (570-621 CVEs, ~60-63 rated Critical, including two actively-exploited zero-days and numerous Excel RCE fixes) — none of which correspond to the CVE numbers in this bundle, but which establishes the unusually high patch volume backdrop against which A26-08-01 was issued. Remediation is straightforward: apply the Edge Stable update (151.0.4129.59 or later) and the corresponding Office/365 Apps security updates via Windows Update or the Microsoft Update Catalog.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1566 Phishing
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1036 Masquerading
- T1539 Steal Web Session Cookie
- T1217 Browser Information Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1499 Endpoint Denial of Service
- T1565 Data Manipulation

## Sources

- [GovCERT.HK Security Alert (A26-08-01): Multiple Vulnerabilities in Microsoft Products](https://www.govcert.gov.hk/en/alerts_detail.php?id=1994)
- [HKCERT Security Bulletin: Microsoft Edge Multiple Vulnerabilities](https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260803)
- [Microsoft Edge release notes for Stable Channel](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnote-stable-channel)
- [Release notes for Microsoft Edge Security Updates](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security)
- [Release notes for Microsoft Office security updates (Microsoft 365 Apps)](https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates)
- [CISA Known Exploited Vulnerabilities Catalog (checked for A26-08-01 CVE bundle, none listed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [Microsoft Patches a Record 570 Security Flaws (July 2026 Patch Tuesday)](https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/)
- [Zero Day Initiative — The July 2026 Security Update Review](https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review)
- [Chrome Security Update Fixes 3 Critical Use-After-Free Bugs (CVE-2026-15899)](https://securityonline.info/chrome-security-update-cve-2026-15899/)
- [Google Chrome Stable Update Patches 12 High-Severity Browser Flaws](https://mallory.ai/stories/019f87cb-fa4b-7f7d-920a-1119f7116356)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1827