CVE-2026-70328 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office products, particularly those using Microsoft Excel, should assess exposure and prioritize patching vulnerable versions to prevent potential information disclosure.

Why it matters

CVE-2026-70328 is a MEDIUM-severity vulnerability in Microsoft Excel that allows unauthorized information disclosure over a network. Defenders should prioritize patching vulnerable versions of Microsoft Office products, particularly Microsoft Excel, to prevent potential information disclosure. This requires verifying inventory, checking for vulnerable versions, and monitoring for potential disclosure attempts.

• Verify patch status of Microsoft Office products to prevent information disclosure
• Assess exposure of Microsoft Excel and Office products in the environment
• Monitor for potential information disclosure attempts
• Prioritize patching for high-risk environments

Technical summary

The vulnerability is caused by an out-of-bounds read in Microsoft Office Excel, allowing an unauthorized attacker to disclose information over a network. Affected products include Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server.

Defensive priority

Defenders should prioritize patching vulnerable versions of Microsoft Excel and Office products to prevent potential information disclosure.

Recommended defensive actions

• Patch vulnerable versions of Microsoft Excel and Office products
• Verify inventory of Microsoft Office products and check for vulnerable versions
• Monitor for potential information disclosure attempts

Evidence notes

The CVE record and source item provide details on the vulnerability, affected products, and references to vendor advisories. The vulnerability is caused by an out-of-bounds read in Microsoft Office Excel, allowing an unauthorized attacker to disclose information over a network. The evidence is limited to public sources and may not be comprehensive. Defenders should verify the patch status of Microsoft Office products, assess exposure, and monitor for potential information disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.