On July 14, 2026, Microsoft released its monthly security updates for Office, closing a serious hole in Excel that an attacker could use to take over a computer simply by tricking someone into opening a malicious spreadsheet. The vulnerability, tracked as CVE-2026-55058, carries a CVSS score of 7.8 and is classified as a remote code execution flaw, affecting nearly every supported version of Office. Although exploitation requires user interaction—the victim must open a booby-trapped file—the attack vector is depressingly common: a well-crafted phishing email or a shared cloud document.

A Closer Look at the Vulnerability

Microsoft’s Security Update Guide describes CVE-2026-55058 as an out-of-bounds read vulnerability (CWE-125) in Excel. An unauthorized attacker can exploit this by preparing a specially crafted workbook. When a user opens the file, the flaw triggers, and the attacker can execute code with the same privileges as the current Excel process. Because most people run Office with standard user rights, an immediate system takeover might not happen, but an attacker could still steal data, install malware, or move laterally through a network.

The CVSS vector for this bug is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Translated, that means:
- Attack Vector (AV): Local – the exploit is triggered on the victim’s machine, not by network traffic alone.
- Attack Complexity (AC): Low – no special conditions needed beyond the file processing.
- Privileges Required (PR): None – no existing account access needed.
- User Interaction (UI): Required – the victim must open the file or perform some action.
- Scope (S): Unchanged – the exploit stays within the same security context.
- Confidentiality, Integrity, Availability impact: High – total compromise of data and control.

This combination explains why Microsoft classifies it as “remote code execution” despite the local vector. As the advisory notes, “The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.” The attacker can be anywhere in the world when they craft and send the malicious file; the actual exploitation happens locally when Excel parses the corrupted data. It’s a classic client-side RCE.

Who Needs to Patch, and How

The patch applies to a wide swath of Office installations:
- Microsoft 365 Apps for enterprise (Office 365 Click-to-Run)
- Excel 2016 (MSI-based installations) – versions earlier than 16.0.5561.1001 are vulnerable
- Office 2019, Office LTSC 2021, and Office LTSC 2024 (both perpetual and subscription models)
- Office for Mac (all supported editions) – requires update to version 16.111.26071215 or newer
- Office Online Server – versions before 16.0.10417.20175

For most home and business users on Microsoft 365, the update arrives automatically through Click-to-Run in the background. You can check by going to File > Account > Update Options > Update Now in any Office app. For those running older MSI-based versions (like Excel 2016), the patch must be downloaded from Microsoft Update or Windows Update for consumers, or deployed via WSUS, Configuration Manager, or third-party patching tools in enterprise environments.

Mac users should look for Microsoft AutoUpdate to fetch the latest Office package. Office Online Server administrators will need to apply the update following Microsoft’s server-specific guidance—workstation patch policies often don’t cover server products. As of this writing, there are no confirmed reports of active exploitation, but that can change quickly once patch details are public.

The Attack Scenario: Why a Simple Spreadsheet Is a Threat

Excel vulnerabilities like this one are consistently popular among cybercriminals because they blend into daily work routines. Finance, accounting, HR, and executive teams frequently exchange spreadsheets with external parties, making a malicious invoice or budget report a plausible attachment. Even with security controls like Protected View and Mark of the Web (MOTW) in place, a convincing lure can persuade a user to click “Enable Editing” or circumvent warnings. And because Excel is a legitimate business tool, blocking all spreadsheet attachments isn’t feasible.

The local attack vector label might suggest a reduced threat, but that’s misleading. The “local” merely indicates that the vulnerability itself is triggered by local file processing, not that the attacker physically needs access to the device. Email gateways, cloud storage links, and compromised websites remain effective delivery mechanisms. According to Microsoft’s own advisory, the attacker “needs to execute code from the local machine” but can certainly be remote when staging the attack.

Not All Patch Tuesdays Are Equal: Context

Microsoft Office has been a perennial target for RCE flaws—from macro-based malware in the ’90s to DDE attacks in Word, to the MSDT Follina vulnerability in 2022. Each generation reminds users and admins that document-based attacks aren’t relics. Attackers adapt to new security features: when macros became blocked by default, they shifted to other techniques like OLE embedding or, as in this case, parsing bugs.

CVE-2026-55058 follows that pattern. It’s an out-of-bounds read, a memory safety bug that often results in information disclosure or code execution. Microsoft has been systematically hardening Office against such attacks, using technologies like Control Flow Guard and sandboxing, but parsing complex binary formats like Excel’s XLS and XLSX is inherently risky.

What You Must Do—Starting Now

  1. Apply the July 2026 security update immediately. Verify the build numbers mentioned above. If you can’t patch right away (e.g., due to a controlled rollout), use the following mitigations.
  2. Configure Office security settings. Enable “Block macros from running in Office files from the Internet” in Group Policy or the Office 365 Admin Center. Consider disabling all macros except digitally signed ones. Ensure Protected View is enabled for files originating from the internet.
  3. Strengthen email and collaboration defenses. Adjust attachment filtering rules to quarantine suspicious file types, and use sandboxing for any documents that arrive from external sources. Remind users to scrutinize unexpected spreadsheets, even from known contacts.
  4. Monitor endpoint logs. After patching, IT teams should monitor for attempts to exploit this vulnerability (e.g., Office crashes, unexpected child processes spawned by Excel). This can help spot targeted attacks.
  5. Update third-party software that leverages Excel. If you use applications that interact with Excel files programmatically, ensure the underlying Excel version is patched; otherwise, those apps become indirect attack vectors.

For home users, the golden rule remains: don’t open Excel attachments you weren’t expecting, and keep Office up-to-date via Windows Update.

The Broader Outlook

Microsoft rarely provides advance notice about upcoming Office patches, but the July update demonstrates that vulnerabilities in parsing engines are still being discovered and fixed. As attackers continue to innovate with social engineering, document-based exploits will remain a critical vector. Future updates might include further memory-corruption fixes, especially as security researchers and Microsoft’s own tools uncover issues in legacy and current codebases.

Users and admins should treat every Patch Tuesday as an opportunity to reassess their Office update processes—automated updates, quick patch deployment cycles, and user education form the best defense against the next Excel RCE, which is likely already lurking in some researcher’s queue.