CVE-2026-97747 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office installations, particularly those using Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and other affected versions.

Why it matters

CVE-2026-97747 is a high-severity vulnerability in Microsoft Office Excel that allows remote code execution. Defenders should prioritize patching affected versions and assess exposure of Microsoft Office installations.

• Potential remote code execution
• Network exploitation possible over the internet
• Requires verification of affected versions and exposure
• Patching vulnerable versions is a priority

Technical summary

A use after free vulnerability in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. This vulnerability affects Microsoft Office installations, particularly those using Microsoft 365 Apps for Enterprise and Microsoft Office 365 for Mac. The vulnerability can be exploited over the internet, and defenders should prioritize patching affected versions and assess exposure of affected systems.

Defensive priority

Defenders should prioritize patching vulnerable Microsoft Office versions and assess exposure of affected systems.

Recommended defensive actions

• Patch vulnerable Microsoft Office versions
• Assess exposure of affected systems
• Verify inventory of Microsoft Office installations

Evidence notes

The CVE record and Microsoft Office security updates provide details on the vulnerability and affected versions. Evidence is limited to public sources and may not be comprehensive. Defenders should verify affected scope and exposure using official advisories and CVE records. Additional verification may be required to confirm affected product deployments and assess potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.