Microsoft 365 Apps: Security feature bypass in Word
Summary
A security feature bypass vulnerability in Microsoft Office Word relies on untrusted inputs in a security decision (CWE-807). A local, unauthorized attacker may bypass a security feature, for example by getting a user to open a crafted Word document, as the CVSS vector requires user interaction. CVSS 7.8 (High); the vulnerability was published with the October 2026 Microsoft security updates.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 onwards, up to the fixed build (not stated in the CVE record)
- Office 365 for Mac: 1.0.0 to below 16.114.26101123
- Office LTSC 2024: 16.0.0 to below 16.0.17932.21056
- Office LTSC for Mac 2021: 16.0.1 to below 16.114.26101123
- Office LTSC for Mac 2024: 16.0.0 to below 16.114.26101123
Fixed in
Unknown for the fixed build numbers; check the Microsoft advisory before rollout.
- Apply the October 2026 Microsoft Office security update.
- Confirm the affected component (Word or PowerPoint), as Microsoft's release notes list the CVE under PowerPoint.
Workaround
Unknown. No Microsoft workaround found; patching is the only documented path.
Exploitation
- Not listed in CISA KEV at the time of research.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found. Not known to be exploited.
Our recommendation
- Check the MSRC advisory for the fixed build of each Office branch.
- Deploy the October 2026 Office security update to all endpoints with Word.
- Verify the update is installed and review handling of untrusted Word attachments.
- Re-check KEV and exploit sources in a few weeks.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-88210 msrc.microsoft.com
- Microsoft 365 Apps security updates learn.microsoft.com
- OpenCVE: CVE-2026-88210 app.opencve.io
- Vulners: CVE-2026-88210 vulners.com
- SonicWall: Microsoft security bulletin coverage, October 2026 www.sonicwall.com
- Strix: CVE-2026-88210 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:05.
Original description (NVD)
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.