Changeflow GovPing Data Privacy & Cybersecurity Multiple Microsoft Office Vulnerabilities Allow...
Priority review Guidance Added Final

Multiple Microsoft Office Vulnerabilities Allow Remote Code Execution, Data Breach

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published
Detected
Email

Summary

CERT-FR published security advisory CERTFR-2026-AVI-0441 alerting organizations to 12 critical vulnerabilities in Microsoft Office products including Excel, PowerPoint, Office 2016/2019/LTSC 2021/2024, and Office Online Server. The vulnerabilities allow remote code execution and data confidentiality breaches. Users are advised to apply Microsoft's security patches immediately.

View original document View source feed page

What changed

CERT-FR issued an advisory identifying 12 distinct vulnerabilities in Microsoft Office affecting multiple versions including Office 2016, 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps, and Office Online Server. The vulnerabilities present two primary risks: remote code execution allowing attackers to run arbitrary code, and data confidentiality breaches enabling unauthorized access to sensitive information. Specific affected versions include Excel and PowerPoint 2016 prior to build 16.0.5548.1000/1001, Office LTSC for Mac 2021 and 2024 prior to 16.108.26041219, and Office Online Server prior to 16.0.10417.20113.

Organizations running any affected Microsoft Office installation face immediate security risk and should prioritize patching. Security teams should inventory Office installations, identify vulnerable versions, and deploy Microsoft patches from the referenced CVE bulletins. Given the availability of patches through Microsoft's regular update mechanism, no workaround options are documented in the advisory—immediate patch deployment is the recommended remediation path.

What to do next

  1. Apply Microsoft security patches for affected Microsoft Office products
  2. Refer to Microsoft Security Update Guide for CVE-specific patches
  3. Update Office 2016 to version 16.0.5548.1000 or later for Excel and general Office fixes

Archived snapshot

Apr 15, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 15 avril 2026 N° CERTFR-2026-AVI-0441 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans Microsoft Office

Gestion du document

| Référence | CERTFR-2026-AVI-0441 |
| Titre | Multiples vulnérabilités dans Microsoft Office |
| Date de la première version | 15 avril 2026 |
| Date de la dernière version | 15 avril 2026 |
| Source(s) | Bulletin de sécurité Microsoft Office CVE-2026-23657 du 14 avril 2026
Bulletin de sécurité Microsoft Office CVE-2026-32188 du 14 avril 2026
Bulletin de sécurité Microsoft Office CVE-2026-32189 du 14 avril 2026
Bulletin de sécurité Microsoft Office CVE-2026-32190 du 14 avril 2026
Bulletin de sécurité Microsoft Office CVE-2026-32197 du 14 avril 2026
Bulletin de sécurité Microsoft Office CVE-2026-32198 du 14 avril 2026
Bulletin de sécurité Microsoft Office CVE-2026-32199 du 14 avril 2026
Bulletin de sécurité Microsoft Office CVE-2026-32200 du 14 avril 2026
Bulletin de sécurité Microsoft Office CVE-2026-33095 du 14 avril 2026
Bulletin de sécurité Microsoft Office CVE-2026-33114 du 14 avril 2026
Bulletin de sécurité Microsoft Office CVE-2026-33115 du 14 avril 2026
Bulletin de sécurité Microsoft Office CVE-2026-33822 du 14 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risques

  • Atteinte à la confidentialité des données
  • Exécution de code arbitraire à distance

Systèmes affectés

  • Microsoft 365 Apps pour Enterprise pour systèmes 32 bits
  • Microsoft 365 Apps pour Enterprise pour systèmes 64 bits
  • Microsoft Excel 2016 (édition 32 bits) versions antérieures à 16.0.5548.1000
  • Microsoft Excel 2016 (édition 64 bits) versions antérieures à 16.0.5548.1000
  • Microsoft Office 2016 (édition 32 bits) versions antérieures à 16.0.5548.1000
  • Microsoft Office 2016 (édition 64 bits) versions antérieures à 16.0.5548.1000
  • Microsoft Office 2019 pour éditions 32 bits
  • Microsoft Office 2019 pour éditions 64 bits
  • Microsoft Office LTSC 2021 pour éditions 32 bits
  • Microsoft Office LTSC 2021 pour éditions 64 bits
  • Microsoft Office LTSC 2024 pour éditions 32 bits
  • Microsoft Office LTSC 2024 pour éditions 64 bits
  • Microsoft Office LTSC pour Mac 2021 versions antérieures à 16.108.26041219
  • Microsoft Office LTSC pour Mac 2024 versions antérieures à 16.108.26041219
  • Microsoft PowerPoint 2016 (édition 32 bits) versions antérieures à 16.0.5548.1001
  • Microsoft PowerPoint 2016 (édition 64 bits) versions antérieures à 16.0.5548.1001
  • Office Online Server versions antérieures à 16.0.10417.20113

Résumé

De multiples vulnérabilités ont été découvertes dans Microsoft Office. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 15 avril 2026 Version initiale

Related changes

Favicon for www.cert.ssi.gouv.fr Multiple Vulnerabilities in Tenable Security Center Allow Remote Code Execution
Priority review Apr 10, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Microsoft Edge Security Vulnerabilities Affecting Bypass and Remote Code Execution
Priority review Apr 13, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Windows Vulnerabilities Enable Code Execution, Privilege Escalation
Urgent Apr 15, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-FR Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from CERT-FR.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Press inquiries →

Classification

Agency
CERT-FR
Published
April 15th, 2026
Instrument
Guidance
Legal weight
Non-binding
Stage
Final
Change scope
Substantive
Document ID
CERTFR-2026-AVI-0441

Who this affects

Applies to
Government agencies Technology companies Employers
Industry sector
5112 Software & Technology
Activity scope
Software vulnerability management Patch deployment Remote code execution prevention
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Data Privacy Software & Technology

Browse Categories

Agriculture & Food Safety 64 AI Regulation 3 Banking & Finance 292 Consumer Protection 44 Courts & Legal 361 Data Privacy & Cybersecurity 73 Defense & National Security 51 Education 19 Energy 100 Environment 86 Environmental Regulation 7 Financial Regulation 2 Government & Legislation 279 Healthcare 136 Housing 16 Immigration 8 Insurance 58 Labor & Employment 113 Legal & Judicial 2 Pharma & Drug Safety 104 Public Health 2 Securities & Markets 103 Securities Regulation 6 Tax 65 Telecom & Technology 47 Trade & Sanctions 135 Transportation 57

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!