Threat reportVulnerabilityTL-2026-3715
Microsoft Patches Two Dozen High-Severity RCE Flaws in Office (Word, Excel, Outlook, PowerPoint, SharePoint) - October 2026
Microsoft Patches Two Dozen High-Severity RCE Flaws in (TL-2026-3715), also tracked as October 2026 Microsoft Office RCE patches, is a high-severity software vulnerability scored CVSS 9.8, first published 2026-10-16. It has no confirmed attribution, affects Microsoft Word, references 35 CVEs (CVE-2026-88178, CVE-2026-70215, CVE-2026-88144), maps to 6 MITRE ATT&CK techniques (T1190, T1203, T1204.002), and is covered by 9 detection rules and 3 indicators of compromise.
- CVSS
- 9.8/10High
- CVEs
- 35Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 3Indicators of compromise
Key facts for TL-2026-3715
- Threat ID
- TL-2026-3715
- Also known as
- October 2026 Microsoft Office RCE patches, Office Preview Pane RCE batch
- Severity
- HIGH
- CVSS
- 9.8
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 3
How Microsoft Patches Two Dozen High-Severity RCE Flaws in works
Microsoft's October 2026 updates fixed over 30 new Office-related vulnerabilities per SecurityWeek, including 24 high-severity remote code execution flaws, six exploitable via the Preview Pane. Microsoft reports none of the newly resolved issues were exploited in the wild as zero-days.
SecurityWeek (2026-10-16) reports that Microsoft patched more than 30 new vulnerabilities, most in the Office suite. Twenty-four are high-severity remote code execution (RCE) flaws, with six exploitable through the Preview Pane. Most RCE fixes affect Word, with fewer in Excel, Outlook, PowerPoint and SharePoint. Root causes are mostly buffer overflows, plus off-by-one errors, use-after-free bugs, path traversal and numeric truncation. Exploitation requires an attacker to send a specially crafted file, such as a malicious document, and convince the recipient to open it; for the Preview Pane cases, viewing the file in the pane is enough. The same release fixed multiple information disclosure bugs, one security bypass, an ASP.NET Core denial-of-service flaw, an Identity Web elevation-of-privilege flaw and an MSAL for Node.js information disclosure flaw. Updates also shipped for Office LTSC for Mac 2021 and 2024 and Office 365 for Mac. Microsoft states none of the newly fixed issues were exploited as zero-days, and the article gives no CVE IDs or CVSS scores.
SOURCE CAVEAT: the SecurityWeek article does not list CVE IDs. The CVE list below was taken from independent October 2026 Patch Tuesday coverage (CrowdStrike, Talos, Qualys, Office Watch), which describe a much larger release (about 1,400 CVEs, 173 Office fixes, 26 Critical Office flaws). Those counts differ from SecurityWeek's, so the exact mapping of each CVE to SecurityWeek's '24 RCE / 6 Preview Pane' figure is not confirmed. The CVE list is the set of Office RCE CVEs named in that coverage, so treat it as related rather than a one-to-one match. Per CrowdStrike, the Preview Pane vector applies to PowerPoint CVE-2026-88178, CVE-2026-70215, CVE-2026-88144 and CVE-2026-88207, Word CVE-2026-70269 and CVE-2026-88185, and Outlook CVE-2026-70291 and CVE-2026-88156 (Reading Pane). CVE-2026-88178 (PowerPoint, CVSS 9.8) is the most severe and can reportedly be triggered unauthenticated through a crafted presentation submitted to an Office Online service. Talos classifies the top Outlook and Word bugs as heap/stack buffer overflow, double free and untrusted pointer dereference (Word CVE-2026-70300, CVSS 9.8). CVE-2026-102866 (SharePoint, CVSS 8.1) is an unauthenticated token-spoofing elevation of privilege. Office LTSC 2021 support ended 2026-10-13, so October is its final update. The only exploited zero-day in the wider release is CVE-2026-96951 (Windows Shell, Mark of the Web bypass), which is not an Office bug but weakens downstream Office protections; it carries a CISA due date of 2026-10-16.
MITRE ATT&CK techniques used in TL-2026-3715
Initial Access
T1190 Exploit Public-Facing Application; T1566.001 Spearphishing Attachment
Execution
T1203 Exploitation for Client Execution; T1204.002 Malicious File
Impact
T1499.004 Application or System Exploitation
defense-impairment
Affected products and versions in Microsoft Patches Two Dozen High-Severity RCE Flaws in
- Microsoft — Word
Vulnerable versions: Supported Office versions prior to the October 2026 update
Fixed in: October 2026 security update - Microsoft — Excel
Vulnerable versions: Supported Office versions prior to the October 2026 update
Fixed in: October 2026 security update - Microsoft — Outlook
Vulnerable versions: Supported Office versions prior to the October 2026 update
Fixed in: October 2026 security update - Microsoft — PowerPoint
Vulnerable versions: Supported Office versions prior to the October 2026 update
Fixed in: October 2026 security update - Microsoft — Visio
Vulnerable versions: Supported Office versions prior to the October 2026 update
Fixed in: October 2026 security update - Microsoft — SharePoint Server
Vulnerable versions: Versions prior to the October 2026 update
Fixed in: October 2026 security update - Microsoft — Office LTSC for Mac 2021 and 2024, Office 365 for Mac
Vulnerable versions: Versions prior to the October 2026 update
Fixed in: October 2026 update - Microsoft — ASP.NET Core, Identity Web, MSAL for Node.js
Vulnerable versions: Versions prior to the October 2026 fixes (see MSRC)
Fixed in: Versions per MSRC update guide
Remediation for Microsoft Patches Two Dozen High-Severity RCE Flaws in
Patches
- October 2026 Microsoft Office security updates, including Office LTSC for Mac 2021 and 2024 and Office 365 for Mac; see https://msrc.microsoft.com/update-guide/
Immediate actions
- Apply the October 2026 Microsoft Office security updates (Word, Excel, Outlook, PowerPoint, Visio, SharePoint Server, Office for Mac) - Office Watch advises prioritising Outlook and scheduling SharePoint server updates this week
- Do not open or preview unsolicited Office documents or emails until patched
- Update Microsoft.Identity.Web, @azure/msal-node and ASP.NET Core to the fixed versions listed in the MSRC update guide
Workarounds
- Disable the Preview Pane in Windows Explorer and Outlook until patches are deployed
- Block or quarantine Office attachments from untrusted senders at the mail gateway
Longer-term hardening
- Migrate Office LTSC 2021 (support ended 2026-10-13) to Microsoft 365 Apps or Office LTSC 2024
- Enforce Protected View and Mark of the Web handling for files from email and the internet
- Deploy EDR with behavioral detection for Office applications spawning child processes
CVEs associated with Microsoft Patches Two Dozen High-Severity RCE Flaws in
- CVE-2026-88178
- CVE-2026-70215
- CVE-2026-88144
- CVE-2026-88207
- CVE-2026-70269
- CVE-2026-88185
- CVE-2026-70300
- CVE-2026-70242
- CVE-2026-70291
- CVE-2026-88156
- CVE-2026-97016
- CVE-2026-97749
- CVE-2026-100209
- CVE-2026-100210
- CVE-2026-100211
- CVE-2026-105718
- CVE-2026-97739
- CVE-2026-97741
- CVE-2026-97742
- CVE-2026-97745
- CVE-2026-97753
- CVE-2026-97755
- CVE-2026-97756
- CVE-2026-97758
- CVE-2026-97759
- CVE-2026-97761
- CVE-2026-97765
- CVE-2026-97767
- CVE-2026-97776
- CVE-2026-97778
- CVE-2026-97780
- CVE-2026-102855
- CVE-2026-102856
- CVE-2026-102857
- CVE-2026-102866
Weaknesses (CWE) in Microsoft Patches Two Dozen High-Severity RCE Flaws in
CWE-121, CWE-122, CWE-125, CWE-190, CWE-191, CWE-193, CWE-197, CWE-22, CWE-415, CWE-416
Timeline of Microsoft Patches Two Dozen High-Severity RCE Flaws in
- Earlier precedent: Microsoft's August 2026 Patch Tuesday also shipped Office bugs triggerable just by previewing a file (Office Watch), showing a recurring Preview Pane attack surface
- Support for Office LTSC 2021 ends; the October update is its final security update
- Microsoft releases October 2026 Patch Tuesday updates, including the Office RCE fixes for Word, Excel, Outlook, PowerPoint, Visio and SharePoint
- Only exploited-in-the-wild zero-day of the release, Windows Shell Mark of the Web bypass CVE-2026-96951, is patched alongside the Office fixes
- CrowdStrike flags PowerPoint CVE-2026-88178 (CVSS 9.8, Preview Pane) as publicly disclosed at patch time, though not exploited in the wild
- Qualys publishes its October 2026 Patch Tuesday review noting 134 Office vulnerabilities and the exploited Windows Shell zero-day CVE-2026-96951
- SecurityWeek reports 24 high-severity Office RCE flaws, six exploitable via the Preview Pane, with no zero-day exploitation of the newly fixed issues
- CISA remediation due date for the exploited Windows Shell Mark of the Web bypass CVE-2026-96951, a related but non-Office flaw
Sources cited for Microsoft Patches Two Dozen High-Severity RCE Flaws in
- Microsoft Patches Two Dozen RCE Flaws in Office (SecurityWeek)
- October 2026 Patch Tuesday: Updates and Analysis (CrowdStrike)
- Microsoft Patch Tuesday for October 2026 - Snort rules and prominent vulnerabilities (Cisco Talos)
- Microsoft Patch Tuesday, October 2026 Security Update Review (Qualys ThreatPROTECT)
- October 2026 Patch Tuesday: 173 Office Fixes, 26 Critical Flaws, and Office 2021's Final Update (Office Watch)
- Microsoft Security Response Center Update Guide
- MC1472429 - Support for Office LTSC 2021 will end on October 13, 2026
Detection coverage for TL-2026-3715
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3715 across Splunk SPL, Microsoft KQL and Sigma, covering 3 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.