CVE-2026-55045

This is a security bug in Microsoft Office that can be turned into a way for an attacker to run code on a computer. Think of it like Office has a “reading past the end” mistake; a malicious person can use that mistake to make the computer do something harmful. If your business runs a vulnerable Office or SharePoint server version, updating is the key protection.

This matters to you if your organization uses Microsoft Office (including Microsoft 365 Apps) or runs Microsoft SharePoint Server 2016/2019/Subscription Edition. The vulnerability requires that a vulnerable Office version is installed, and it does not require a user to click or provide a login.

Reachability is not fully clear from the available information, so treat any machine/server running a vulnerable version as potentially at risk—especially where an attacker could get local access to that device or environment.

This is marked RED because it allows arbitrary code execution on a local system when a vulnerable Microsoft Office/SharePoint component is installed, and it requires neither authentication nor user interaction. Even though no clear public, dated exploitation report or public exploit code was found, you should prioritize patching because the impact (code execution and possible takeover) is high. Update affected systems immediately per the fixed versions listed.