0 spills in 2025 for Microsoft Office
Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.
Past orders
- highpatchedexploited Microsoft SharePoint Code Injection Vulnerability Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. Added to CISA KEV on 2026-09-25 (federal deadline 2026-09-28).
- highpatchedexploited Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution. Added to CISA KEV on 2026-08-18 (federal deadline 2026-08-21).
- highpatchedexploited Microsoft SharePoint Weak Authentication Vulnerability Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network. Added to CISA KEV on 2026-08-18 (federal deadline 2026-08-21).
- highpatchedexploited Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network. Added to CISA KEV on 2026-07-22 (federal deadline 2026-07-25).
- highpatchedexploited Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. Added to CISA KEV on 2026-07-16 (federal deadline 2026-07-19).
- highpatchedexploited Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network. Added to CISA KEV on 2026-07-14 (federal deadline 2026-07-17).
- criticalpatchedexploited Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network. Added to CISA KEV on 2026-07-01 (federal deadline 2026-07-04).
- criticalpatchedexploited Check Point Security Gateway Improper Authentication Vulnerability Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password. Added to CISA KEV on 2026-06-08 (federal deadline 2026-06-11).
- highpatchedexploited Microsoft Exchange Server Cross-Site Scripting Vulnerability Microsoft Microsoft Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context. Added to CISA KEV on 2026-05-15 (federal deadline 2026-05-29).
- highpatchedexploited Microsoft Office Remote Code Execution Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object. Added to CISA KEV on 2026-04-14 (federal deadline 2026-04-28).
- highpatchedexploited Microsoft SharePoint Server Improper Input Validation Vulnerability Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network. Added to CISA KEV on 2026-04-14 (federal deadline 2026-04-28).
- criticalpatchedexploited Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution. Added to CISA KEV on 2026-04-13 (federal deadline 2026-04-27).
- highpatchedexploited Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. Added to CISA KEV on 2026-03-18 (federal deadline 2026-03-21).
- highpatchedexploited Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally. Added to CISA KEV on 2026-02-10 (federal deadline 2026-03-03).
- highpatchedexploited Microsoft Office Security Feature Bypass Vulnerability Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Added to CISA KEV on 2026-01-26 (federal deadline 2026-02-16).
Follow Microsoft Office
RSS: /feed.xml?stack=office. JSON: /incidents.json?stack=office. Or add it to your usual for delivery.