# Microsoft Patches Two Dozen High-Severity RCE Flaws in Office (Word, Excel, Outlook, PowerPoint, SharePoint) - October 2026

> Microsoft's October 2026 updates fixed over 30 new Office-related vulnerabilities per SecurityWeek, including 24 high-severity remote code execution flaws, six exploitable via the Preview Pane. Microsoft reports none of the newly resolved issues were exploited in the wild as zero-days.

- **Published:** 2026-10-16T08:11:04Z
- **Last reviewed:** 2026-10-16T08:11:04Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3715
- **ID:** TL-2026-3715
- **Severity:** HIGH (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 3 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-88178, CVE-2026-70215, CVE-2026-88144, CVE-2026-88207, CVE-2026-70269, CVE-2026-88185, CVE-2026-70300, CVE-2026-70242, CVE-2026-70291, CVE-2026-88156, CVE-2026-97016, CVE-2026-97749, CVE-2026-100209, CVE-2026-100210, CVE-2026-100211, CVE-2026-105718, CVE-2026-97739, CVE-2026-97741, CVE-2026-97742, CVE-2026-97745, CVE-2026-97753, CVE-2026-97755, CVE-2026-97756, CVE-2026-97758, CVE-2026-97759, CVE-2026-97761, CVE-2026-97765, CVE-2026-97767, CVE-2026-97776, CVE-2026-97778, CVE-2026-97780, CVE-2026-102855, CVE-2026-102856, CVE-2026-102857, CVE-2026-102866

## Description

SecurityWeek (2026-10-16) reports that Microsoft patched more than 30 new vulnerabilities, most in the Office suite. Twenty-four are high-severity remote code execution (RCE) flaws, with six exploitable through the Preview Pane. Most RCE fixes affect Word, with fewer in Excel, Outlook, PowerPoint and SharePoint. Root causes are mostly buffer overflows, plus off-by-one errors, use-after-free bugs, path traversal and numeric truncation. Exploitation requires an attacker to send a specially crafted file, such as a malicious document, and convince the recipient to open it; for the Preview Pane cases, viewing the file in the pane is enough. The same release fixed multiple information disclosure bugs, one security bypass, an ASP.NET Core denial-of-service flaw, an Identity Web elevation-of-privilege flaw and an MSAL for Node.js information disclosure flaw. Updates also shipped for Office LTSC for Mac 2021 and 2024 and Office 365 for Mac. Microsoft states none of the newly fixed issues were exploited as zero-days, and the article gives no CVE IDs or CVSS scores.

SOURCE CAVEAT: the SecurityWeek article does not list CVE IDs. The CVE list below was taken from independent October 2026 Patch Tuesday coverage (CrowdStrike, Talos, Qualys, Office Watch), which describe a much larger release (about 1,400 CVEs, 173 Office fixes, 26 Critical Office flaws). Those counts differ from SecurityWeek's, so the exact mapping of each CVE to SecurityWeek's '24 RCE / 6 Preview Pane' figure is not confirmed. The CVE list is the set of Office RCE CVEs named in that coverage, so treat it as related rather than a one-to-one match. Per CrowdStrike, the Preview Pane vector applies to PowerPoint CVE-2026-88178, CVE-2026-70215, CVE-2026-88144 and CVE-2026-88207, Word CVE-2026-70269 and CVE-2026-88185, and Outlook CVE-2026-70291 and CVE-2026-88156 (Reading Pane). CVE-2026-88178 (PowerPoint, CVSS 9.8) is the most severe and can reportedly be triggered unauthenticated through a crafted presentation submitted to an Office Online service. Talos classifies the top Outlook and Word bugs as heap/stack buffer overflow, double free and untrusted pointer dereference (Word CVE-2026-70300, CVSS 9.8). CVE-2026-102866 (SharePoint, CVSS 8.1) is an unauthenticated token-spoofing elevation of privilege. Office LTSC 2021 support ended 2026-10-13, so October is its final update. The only exploited zero-day in the wider release is CVE-2026-96951 (Windows Shell, Mark of the Web bypass), which is not an Office bug but weakens downstream Office protections; it carries a CISA due date of 2026-10-16.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1553.005 Mark-of-the-Web Bypass
- T1499.004 Application or System Exploitation

## Sources

- [Microsoft Patches Two Dozen RCE Flaws in Office (SecurityWeek)](https://www.securityweek.com/microsoft-patches-two-dozen-rce-flaws-in-office/)
- [October 2026 Patch Tuesday: Updates and Analysis (CrowdStrike)](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-october-2026/)
- [Microsoft Patch Tuesday for October 2026 - Snort rules and prominent vulnerabilities (Cisco Talos)](https://blog.talosintelligence.com/microsoft-patch-tuesday-for-october-2026/)
- [Microsoft Patch Tuesday, October 2026 Security Update Review (Qualys ThreatPROTECT)](https://threatprotect.qualys.com/2026/10/14/microsoft-patch-tuesday-october-2026-security-update-review/)
- [October 2026 Patch Tuesday: 173 Office Fixes, 26 Critical Flaws, and Office 2021's Final Update (Office Watch)](https://office-watch.com/2026/october-2026-patch-tuesday-office-critical-fixes/)
- [Microsoft Security Response Center Update Guide](https://msrc.microsoft.com/update-guide/)
- [MC1472429 - Support for Office LTSC 2021 will end on October 13, 2026](https://mc.merill.net/message/MC1472429)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3715