CVE-2026-64911

This flaw is in Microsoft Office and can be triggered when someone gets a user to open a specially made Office file. Once opened, it can allow harmful code to run on the computer, similar to how a booby-trapped document could run malware as soon as you view it.

This matters if your business uses Microsoft Office (including Microsoft 365 Apps, Microsoft 365, Office 2019/2021/2024, and Microsoft Office on macOS: Microsoft Office 365 for Mac and the LTSC for Mac 2021/2024). It primarily becomes a real risk when an attacker can persuade a user to open a malicious Office document, since the weakness is triggered through Office file usage.

Reachability gate: treat it as a concern if staff open Office files received via email, downloads, or other external sources.

This is RED because Office is widely used and this issue is specifically a code-execution flaw triggered by malicious document handling. The current information also shows actor-linked press attention (Lazarus group) and a patch is available, so there’s no reason to delay updating.