Skip to content
Threat Feed
Subscribe

Product

Excel

11 briefs RSS
high advisory

Microsoft Security Updates — July 2026

Roundup of Microsoft security advisories published in July 2026.

PoC PowerShell +511 roundup
11c 354i updated
high advisory

Persistence via Malicious Microsoft Office Add-ins

Attackers can establish persistence by placing malicious add-ins (e.g., .xll, .xlam) in Microsoft Office startup directories, ensuring execution each time the application launches.

Microsoft Office +2 persistence office-addins windows
2r 1t
high advisory

MSBuild Started by Microsoft Office Application

The Microsoft Build Engine (MSBuild) being started by a Microsoft Office application is an unusual behavior that could indicate a malicious document is executing a payload to evade defenses and execute code.

Word +2 defense-evasion execution msbuild office-macro
2r 2t
medium advisory

XSL Script Execution via COM Interface in Microsoft Office

Adversaries may exploit Microsoft Office applications to execute malicious JScript or VBScript by leveraging the Microsoft.XMLDOM COM interface to process and transform XML documents using XSL scripts, potentially leading to initial access or defense evasion.

Microsoft Office +3 xsl-script com-interface office-macro
2r 5t
medium advisory

Suspicious MS Office Child Process

This rule detects suspicious child processes spawned by Microsoft Office applications, indicating potential exploitation or malicious macros used for initial access, command execution, defense evasion, and discovery activities.

Microsoft Office +3 initial-access execution defense-evasion discovery windows
2r 18t 1c
high threat

WindShift APT Targeting Middle East with OSX.WindTail macOS Implant

The WindShift APT group is targeting Middle Eastern governments with a first-stage macOS implant called OSX.WindTail, abusing custom URL schemes for initial infection and establishing persistence via login items, while decrypting embedded strings to identify file extensions of interest.

OSX.WindTail +2 WindShift macos apt cyber-espionage
2r 1t
low advisory

Suspicious Image Load (taskschd.dll) from MS Office

Detection of taskschd.dll image loads from Microsoft Office applications indicates potential COM-based scheduled task creation for persistence, bypassing traditional schtasks.exe usage.

Word +4 persistence execution windows image_load scheduled_task
2r 2t
critical advisory

Microsoft Office Use-After-Free Vulnerability CVE-2026-32190

CVE-2026-32190 is a use-after-free vulnerability in Microsoft Office that allows an unauthorized attacker to execute code locally.

Microsoft Office +3 use-after-free microsoft-office code-execution cve-2026-32190
2r 3t 1c
high threat

Microsoft Excel XLM Macro Remote Code Execution on macOS

A logic flaw in Microsoft Excel allows remote code execution on macOS via malicious XLM macros in SYLK files, bypassing the 'Disable all macros without notification' setting.

exploited Excel +4 xlm rce macro macos sylk
3r
high advisory

Detects Windows XLL File Creation Outside of Typical Location

The creation of an XLL file outside of typical locations can indicate an attempt to abuse Excel COM objects to load and execute a malicious XLL payload, often used in spearphishing attacks to achieve remote code execution.

Excel +3 xll file_creation endpoint
2r 2t
low advisory

Suspicious Command Prompt Network Connection

This alert identifies suspicious network connections initiated by the command prompt (cmd.exe) when executed with arguments indicative of script execution, remote resource access, or originating from Microsoft Office applications, which is a common tactic for downloading payloads or establishing command and control.

Elastic Defend +7 command-prompt network-connection windows execution command-and-control
2r 4t