CVE-2026-68804

This flaw is in Microsoft Excel/Microsoft Office’s handling of certain numbers when processing a document. An attacker can create a specially crafted file that, if opened, tricks the vulnerable program into running code on your device. Think of it like a document “smuggling” instructions that the app executes when you open the file.

This matters if your business uses Microsoft Excel or Microsoft Office (including Microsoft 365 Apps, Microsoft Office 2019/2021, and the Microsoft Office for Mac and LTSC variants listed). It also matters if you host Office Online Server.

Because the issue involves opening a crafted document, risk is tied to whether an attacker can send you a malicious file that your users open and whether your Office build is still before the fixed versions.

This is a RED issue because Microsoft has released fixes for multiple Office products and the tracked activity indicates a real attacker focus on this class of vulnerability. Even though there’s no public exploit code on record and no CISA KEV entry, you should treat this as an active, patch-needed risk for any system that hasn’t been updated yet.