CVE-2026-81947 – Microsoft 365 Apps for Enterprise

This update closes 62 vulnerabilities in Microsoft 365 Apps for Enterprise, one Critical and 61 High. In 61 of them, an attacker can run code remotely, and 11 can raise an attacker's privileges. Most are memory-corruption flaws: heap and stack buffer overflows, use-after-free, double free, and integer overflow. A single crafted file can give an attacker control of the user's machine. Because Office runs on almost every corporate endpoint, this batch has a large attack surface.

CVE-2026-78509 has a CVSS score of 9.8, Critical severity. CVE-2026-69285, CVE-2026-69442, CVE-2026-69529, CVE-2026-69556, CVE-2026-69614, CVE-2026-69629, CVE-2026-69632, CVE-2026-69671, CVE-2026-69678, CVE-2026-69686, CVE-2026-69722, CVE-2026-69742, CVE-2026-69759, CVE-2026-69764, CVE-2026-69767, CVE-2026-69778, CVE-2026-69797, CVE-2026-70125, CVE-2026-72972, CVE-2026-72973, CVE-2026-77901, CVE-2026-78504, CVE-2026-78505, CVE-2026-78507, CVE-2026-78511, CVE-2026-78512, CVE-2026-78514, CVE-2026-78517, CVE-2026-78518, CVE-2026-78521, CVE-2026-78524, CVE-2026-78525, CVE-2026-78526, CVE-2026-80080, CVE-2026-80081, CVE-2026-80085, CVE-2026-81385, CVE-2026-81952, and CVE-2026-81955 each have a CVSS score of 8.8, High severity. CVE-2026-78510 has a CVSS score of 8.4, High severity. CVE-2026-62804, CVE-2026-81386, CVE-2026-81388, CVE-2026-81396, CVE-2026-81397, CVE-2026-81398, CVE-2026-81947, CVE-2026-81948, CVE-2026-81949, CVE-2026-81950, CVE-2026-81951, CVE-2026-81953, CVE-2026-81954, CVE-2026-81956, CVE-2026-81957, CVE-2026-81959, and CVE-2026-81960 each have a CVSS score of 7.8, High severity. CVE-2026-100208 and CVE-2026-77898 each have a CVSS score of 7.5, High severity. CVE-2026-69477 has a CVSS score of 7.3, High severity. CVE-2026-81389 has a CVSS score of 7.0, High severity.