Actively exploited in the wild
Microsoft Office Excel Remote Code Execution Vulnerability
Microsoft - Office · Listed in the CISA KEV since 2025-08-12. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2007-0671
HighCVSS 8.8KEVSummary
Nieokreślona podatność w programie Microsoft Excel 2000, XP, 2003 oraz 2004 dla systemu Mac, a być może także w innych produktach Office, umożliwia zdalnym atakującym, wspieranym przez użytkownika, wykonanie dowolnego kodu za pomocą nieznanych wektorów ataku.
Risk Assessment
Podatność ta stwarza poważne ryzyko dla organizacji, ponieważ może prowadzić do zdalnego wykonania kodu, co może skutkować utratą danych lub przejęciem kontroli nad systemem.
Recommendation
Zaleca się aktualizację oprogramowania Microsoft Excel do najnowszej wersji oraz wdrożenie odpowiednich środków bezpieczeństwa, aby zminimalizować ryzyko ataków wykorzystujących tę podatność.
Related vulnerabilities
- CVE-2026-110243Critical
The network management service on Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command. An authenticated web user with network configuration permissions can exploit this to execute arbitrary operating system commands as root.
- CVE-2026-107861Critical
The system control service on Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.
- CVE-2026-97785Critical
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-83938Critical
Missing authentication for a critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-110063Critical
Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-109122Critical
The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots.
- CVE-2026-105014Critical
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
- CVE-2026-114625Critical
VeloCloud Orchestrator (VCO) on-prem has a security issue that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user, accessing functionality intended for internal use only and not meant to be remotely accessible.
- CVE-2026-79876Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79875Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
Original NVD description (English source)
Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero-day attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS