Multiple Vulnerabilities in Microsoft Office Products (June 2026)

hello@craftedsignal.io — Sun, 14 Jun 2026 09:15:49 +0000

CERT-FR has released an advisory detailing 31 critical and high-severity vulnerabilities affecting numerous Microsoft Office products. These vulnerabilities, identified by CVEs such as CVE-2026-44803 (the first listed) and CVE-2026-47635 (the last listed), were disclosed by Microsoft on June 9, 2026. The flaws impact a wide range of Office applications, including Microsoft 365 Apps, various versions of Excel, Word, PowerPoint, and Office Online Server, across Windows, macOS, and Android platforms. Successful exploitation of these vulnerabilities could lead to arbitrary remote code execution, elevation of privileges on affected systems, and unauthorized access to sensitive data, posing a significant risk to organizational assets. While no specific threat actors or active exploitation campaigns are detailed in the advisory, these types of vulnerabilities are frequently targeted by advanced persistent threats and opportunistic attackers.

Attack Chain

Initial Access: A user receives and opens a specially crafted Microsoft Office document (e.g., Word, Excel, or PowerPoint file) delivered via a phishing email, malicious download, or other social engineering methods.
Exploitation: The malicious document leverages one of the disclosed vulnerabilities (e.g., CVE-2026-44803) within the vulnerable Microsoft Office application upon opening or specific user interaction.
Remote Code Execution: Successful exploitation results in remote code execution (RCE) within the context of the compromised Office application process, allowing the attacker to execute arbitrary commands.
Payload Delivery: The executed code downloads and executes additional malicious payloads (e.g., malware droppers, backdoors, or command-and-control agents) from an external attacker-controlled server.
Privilege Escalation: The attacker may then exploit another vulnerability (e.g., CVE-2026-44812) or leverage a misconfiguration to escalate privileges, gaining higher system access on the compromised host.
Objective Achievement: With elevated privileges and persistent access, the attacker can proceed with their objectives, which may include lateral movement across the network, exfiltration of sensitive data, further system compromise, or deployment of additional malicious software.

Impact

The successful exploitation of these vulnerabilities could have severe consequences for affected organizations. Attackers could gain complete control over compromised systems, leading to extensive data breaches, operational disruption, and the deployment of ransomware or other destructive malware. While the advisory does not specify the number of victims or targeted sectors, the broad impact across common Microsoft Office products means that organizations of all sizes and industries are potentially at risk. The combination of remote code execution, privilege escalation, and data confidentiality compromise could lead to significant financial losses, reputational damage, and regulatory penalties.

Recommendation

Patch CVE-2026-44803, CVE-2026-44812, CVE-2026-44817, CVE-2026-44818, CVE-2026-44819, CVE-2026-44820, CVE-2026-44821, CVE-2026-44822, CVE-2026-44823, CVE-2026-44824, CVE-2026-45455, CVE-2026-45456, CVE-2026-45457, CVE-2026-45458, CVE-2026-45459, CVE-2026-45460, CVE-2026-45461, CVE-2026-45463, CVE-2026-45466, CVE-2026-45469, CVE-2026-45471, CVE-2026-45472, CVE-2026-45474, CVE-2026-45475, CVE-2026-45485, CVE-2026-45486, CVE-2026-45643, CVE-2026-45645, CVE-2026-45649, CVE-2026-47293, and CVE-2026-47635 by applying the latest security updates from Microsoft for all affected Office products and versions immediately.
Deploy the "Detect Suspicious Child Process by Microsoft Office Application" Sigma rule to detect post-exploitation activity from Office applications.
Deploy the "Detect Outbound Network Connection from Microsoft Office Application" Sigma rule to monitor for unusual C2 communications.
Ensure Sysmon process creation (Event ID 1), network connection (Event ID 3), and file creation (Event ID 11) logging is enabled on all Windows endpoints to generate the necessary telemetry for the detection rules in this brief.

Vulnerability in Schneider Electric EcoStruxure IT Data Center Expert Leads to Data Confidentiality Compromise (CVE-2026-8045)

hello@craftedsignal.io — Sun, 14 Jun 2026 09:08:06 +0000

CERT-FR has issued an advisory regarding a significant vulnerability, CVE-2026-8045, discovered in Schneider Electric EcoStruxure IT Data Center Expert products. This flaw affects all versions prior to 9.1.2 and enables an attacker to compromise the confidentiality of data stored or processed by the system. EcoStruxure IT Data Center Expert is a critical management software for data center infrastructure, meaning a breach could expose sensitive operational data, configurations, or even credentials. The vulnerability's exact technical details are not publicly disclosed, but its impact on data confidentiality necessitates immediate patching to mitigate the risk of unauthorized information access and potential exfiltration by malicious actors.

Attack Chain

An attacker identifies a Schneider Electric EcoStruxure IT Data Center Expert instance accessible via the network, potentially through passive reconnaissance.
The attacker determines the target system is running a vulnerable version prior to 9.1.2.
The attacker leverages CVE-2026-8045 by sending specially crafted network requests or inputs to the EcoStruxure IT DCE service.
Successful exploitation of the vulnerability bypasses existing access controls or triggers an information disclosure flaw.
The attacker gains unauthorized access to internal files, databases, or configuration parameters containing sensitive information on the EcoStruxure IT DCE server.
The attacker enumerates and discovers confidential data, which may include operational settings, device credentials, or network topology information.
The attacker extracts or views the identified sensitive data, leading to a breach of data confidentiality.

Impact

The successful exploitation of CVE-2026-8045 directly results in a data confidentiality breach. For organizations utilizing EcoStruxure IT Data Center Expert, this means an attacker could gain unauthorized access to critical data center information, such as device configurations, passwords, operational metrics, and potentially sensitive customer data. Such exposure could lead to further network compromise, intellectual property theft, regulatory fines, reputational damage, and operational disruption. The advisory does not specify observed victim numbers or targeted sectors, but any organization using affected versions is at risk.

Recommendation

Immediately update Schneider Electric EcoStruxure IT Data Center Expert installations to version 9.1.2 or higher as recommended in the Schneider Electric bulletin (SEVD-2026-160-01).
Monitor network connections originating from EcoStruxure IT Data Center Expert systems for unusual outbound traffic patterns, especially large data transfers, using rules like "Detect Large Outbound Network Connections from EcoStruxure IT DCE".
Implement robust network segmentation to restrict direct exposure of EcoStruxure IT Data Center Expert instances, reducing the attack surface for CVE-2026-8045.

Data-Confidentiality - CraftedSignal Threat Feed

Multiple Vulnerabilities in Microsoft Office Products (June 2026)

Attack Chain

Impact

Recommendation

Vulnerability in Schneider Electric EcoStruxure IT Data Center Expert Leads to Data Confidentiality Compromise (CVE-2026-8045)

Attack Chain

Impact

Recommendation