# Microsoft Office / Microsoft 365 Apps for Enterprise Remote Code Execution Vulnerability (CVE-2026-70125)

> CVE-2026-70125 is a high-severity (CVSSv3.1 8.8) remote code execution vulnerability affecting Microsoft Outlook, Microsoft 365 Apps for Enterprise, and Microsoft Office LTSC 2021/2024. Microsoft's Security Update Guide titles it a "Microsoft Outlook Remote Code Execution Vulnerability" and requires user interaction to trigger; HKCERT's alert separately describes the trigger as a user opening a web page with specially crafted content in a vulnerable browser. No public proof-of-concept or in-the-wild exploitation has been reported, and a vendor patch is available via Windows Update / Microsoft Update Catalog.

- **Published:** 2026-09-26T00:00:00Z
- **Last reviewed:** 2026-09-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2659
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-microsoft-outlook-rce-tl-2026-2659.webp?v=8099e815 (Threadlinqs threat intel: CVE-2026-70125 Office RCE: Exploitation Status & Fix (TL-2026-2659) — High severity, 10 IOCs, 9 detection rules.)
- **ID:** TL-2026-2659
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 10
- **CVEs:** CVE-2026-70125

## Description

CVE-2026-70125 was reserved by MITRE on 2026-08-03 and published on 2026-09-23, several days after Microsoft's main September 2026 Patch Tuesday release (2026-09-08). Community trackers (TheWindowsUpdate.com, OffSeq Threat Radar) report that the underlying fix shipped with the September 2026 security updates but that the CVE entry itself was "inadvertently omitted" from the initial September 2026 Security Updates documentation and only surfaced afterward in the MSRC Security Update Guide, meaning organizations that already fully patched in September 2026 do not need further action beyond confirming the update installed.

Microsoft's own advisory title ("Microsoft Outlook Remote Code Execution Vulnerability") and the CVSS vector (AV:N/AC:L/PR:N/UI:R) both point to a client-side vulnerability that is triggered when a user interacts with attacker-supplied content inside Outlook/Office (e.g., a message or crafted file), consistent with no privileges required but user interaction required. HKCERT's Security Alert A26-09-39 (published 2026-09-24, drawing on the same underlying CVE) describes the trigger differently, as a remote attacker enticing a user to open a web page with specially crafted content in a vulnerable browser. Both narratives describe the same class of outcome — a user-interaction-gated, network-vector RCE reachable through content an attacker convinces the victim to open — and are documented here as the two distinct official characterizations found in primary/vendor sources; no source reconciles the exact technical trigger (email message vs. browser-rendered page) with a public technical write-up, and no CWE has been published by NVD/MSRC for this CVE as of last check.

Successful exploitation is rated CVSS impact C:H/I:H/A:H — full compromise of confidentiality, integrity, and availability on the affected endpoint, i.e., arbitrary code execution in the context of the logged-in user. The vulnerability affects Microsoft 365 Apps for Enterprise (builds 16.0.0 and 16.0.1), Microsoft Office LTSC 2021 (build 16.0.1), and Microsoft Office LTSC 2024 (build 16.0.0), on both 32-bit and x64 platforms. EPSS scores the 30-day exploitation probability at 0.44% (approximately the 36th percentile), it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public PoC code or confirmed in-the-wild exploitation has been identified by any of the trackers reviewed (GitHub CVE tracker, OffSeq, Strix.ai, TheHackerWire). A vendor-supplied patch is available and should be applied via Windows Update or the Microsoft Update Catalog.

## MITRE ATT&CK

- T1588.005 Obtain Capabilities: Exploits
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1583.006 Acquire Infrastructure: Web Services
- T1584.006 Compromise Infrastructure: Web Services
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1203 Exploitation for Client Execution
- T1204.001 User Execution: Malicious Link
- T1204.002 User Execution: Malicious File

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Office Application Spawning Script Interpreter or LOLBin — Possible CVE-2026-70125 Exploitation — SPL** (`TL-2026-2659-SPL-002`)

Detects WINWORD.EXE/OUTLOOK.EXE/EXCEL.EXE/POWERPNT.EXE spawning a command interpreter or living-off-the-land binary, the behavioral fingerprint of successful arbitrary-code-execution exploitation of the CVE-2026-70125 Outlook/Office RCE (CVSS C:H/I:H/A:H) once a crafted attachment or link is opened.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1204.002, T1588.006
- **Data sources:** sysmon, microsoft_defender_for_endpoint, windows_security
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval ParentImage=lower(ParentImage), Image=lower(Image)
| where (ParentImage="*\\winword.exe" OR ParentImage="*\\outlook.exe" OR ParentImage="*\\excel.exe" OR ParentImage="*\\powerpnt.exe")
    AND (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\powershell_ise.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe")
| stats count min(_time) as first_seen max(_time) as last_seen by ComputerName, User, ParentImage, Image, CommandLine
| where count > 0
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("winword.exe","outlook.exe","excel.exe","powerpnt.exe")
| where FileName in~ ("cmd.exe","powershell.exe","powershell_ise.exe","mshta.exe","rundll32.exe","regsvr32.exe","wscript.exe","cscript.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
```

### Sigma

```yaml
title: Office Application Spawning Script Interpreter or LOLBin (Possible CVE-2026-70125 Exploitation)
id: a1b2c3d4-2222-4a2b-8c3d-e4f5a6b7c802
status: experimental
description: Detects Office/Outlook processes spawning command interpreters or LOLBins, a pattern consistent with successful exploitation of the CVE-2026-70125 Outlook/Office RCE.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70125
author: Threadlinqs Team
date: 2026-09-26
tags:
  - attack.execution
  - attack.t1203
  - attack.t1204.002
  - attack.resource-development
  - attack.t1588.006
  - cve.2026.70125
  - attack.tool.living_off_the_land
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\outlook.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate macros or add-ins invoking script hosts in managed environments
level: high
```

**Known false positives:**

- Legitimate, digitally-signed Office macros or approved RMM/automation add-ins that launch script hosts

**Tuning notes:** Exclude documented, signed macro-enabled workbooks/add-ins used for IT automation; join against the mail-open event within a 5-minute window to raise fidelity; suppress on hosts already fully patched to the September 2026-or-later Click-to-Run build for CVE-2026-70125.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Microsoft-Themed Phishing Lure Hosted on Cloud Object Storage (CVE-2026-70125 Delivery Vector) — KQL (locked: unlock with TL Creds)
- Office Application Spawning Script Interpreter or LOLBin — Possible CVE-2026-70125 Exploitation — KQL (locked: unlock with TL Creds)
- LOLBin Network Beacon to Cloud Object-Storage Infrastructure Post-Office-Exploitation — KQL (locked: unlock with TL Creds)
- Microsoft-Themed Phishing Lure Hosted on Cloud Object Storage (CVE-2026-70125 Delivery Vector) — Sigma (locked: unlock with TL Creds)
- Office Application Spawning Script Interpreter or LOLBin — Possible CVE-2026-70125 Exploitation — Sigma (locked: unlock with TL Creds)
- LOLBin Network Beacon to Cloud Object-Storage Infrastructure Post-Office-Exploitation — Sigma (locked: unlock with TL Creds)
- Microsoft-Themed Phishing Lure Hosted on Cloud Object Storage (CVE-2026-70125 Delivery Vector) — SPL (locked: unlock with TL Creds)
- LOLBin Network Beacon to Cloud Object-Storage Infrastructure Post-Office-Exploitation — SPL (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [HKCERT Security Alert A26-09-39](https://www.govcert.gov.hk/en/alerts_detail.php?id=2081)
- [CVE-2026-70125 - Security Update Guide - Microsoft Outlook Remote Code Execution Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70125)
- [Microsoft 365 Apps updates - Security updates](https://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates)
- [Office 365 ProPlus (Microsoft 365 Apps) security updates](https://docs.microsoft.com/en-us/officeupdates/office365-proplus-security-updates)
- [CVE-2026-70125 Microsoft Outlook Remote Code Execution Vulnerability](https://thewindowsupdate.com/2026/09/23/cve-2026-70125-microsoft-outlook-remote-code-execution-vulnerability/)
- [CVE-2026-70125: Remote Code Execution in Microsoft 365 Apps for Enterprise - Threat Radar](https://radar.offseq.com/threat/cve-2026-70125-remote-code-execution-in-microsoft-microsoft-365-apps-for-enterprise-df080f622cede4e1)
- [CVE-2026-70125: Microsoft 365 Apps for Enterprise Vulnerability](https://www.strix.ai/cve/CVE-2026-70125)
- [CVE-2026-70125 PoC, Exploit Status & Vulnerability Details](https://www.thehackerwire.com/vulnerability/CVE-2026-70125/)
- [VULN ALERT CVE-2026-70125 (risk 31.0) - microsoft/office](https://github.com/astruzocyber/CVE/issues/652)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2659