Microsoft Office: Security feature bypass through missing user warnings
Summary
A security feature bypass in Microsoft Office allows an unauthorized attacker to get around a protection mechanism over a network. The user interface does not warn the user about unsafe actions (CWE-356). The attack requires user interaction, for example opening a crafted document or file, and according to the CVSS vector only affects integrity.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 up to the build named at https://aka.ms/OfficeSecurityReleases
- Office LTSC 2021: 16.0.1 before 16.0.14334.21048
- Office LTSC 2024: 16.0.0 before 16.0.17932.21140
- Office 2016, 2019 and Office 2024 (non-LTSC): Unknown (not in the CNA product list)
Fixed in
- Office LTSC 2021: 16.0.14334.21048
- Office LTSC 2024: 16.0.17932.21140
- Microsoft 365 Apps for Enterprise: no numeric fixed build stated in the CVE record; see the MSRC advisory
- Fix released with the November 10, 2026 Office security updates
Workaround
Unknown. No workaround is documented in the sources reviewed; applying the November 2026 Office updates is the only confirmed fix.
Exploitation
- Exploited in the wild: no evidence found.
- Public proof of concept: none found.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- CVSS temporal vector E:U (exploit maturity unproven).
- Not publicly disclosed before patching, according to Microsoft's assessment.
Our recommendation
- Install the November 2026 Office security updates on all affected installations.
- Prioritise users who open external documents from email or downloads.
- Check the MSRC advisory for the exact fixed build of Microsoft 365 Apps for Enterprise.
- Monitor NVD and the MSRC page until the analysis is published.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record (CVE Program) www.cve.org
- Microsoft Security Update Guide msrc.microsoft.com
- Microsoft 365 Apps security updates learn.microsoft.com
- CVE-2026-119998 mirror (threatint) cve.threatint.com
- Strix CVE summary www.strix.ai
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
- BleepingComputer Patch Tuesday November 2026 www.bleepingcomputer.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:04.
Original description (NVD)
Product ui does not warn user of unsafe actions in Microsoft Office allows an unauthorized attacker to bypass a security feature over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.