CVE-2026-68815

Imagine opening an Excel file that looks normal, but it secretly tricks Excel into running code on your computer. If a staff member opens that file, the attacker can act as that user—potentially installing malware, stealing data, or disrupting work.

This matters if your business uses Microsoft Excel or Microsoft Office on Windows or macOS (including Microsoft 365 Apps, Office 2019/2021/2024, and Office LTSC for Mac). The risk is primarily tied to whether someone could be tricked into opening a malicious Excel/Office document—there’s no need to log in first. If a malicious file is not reachable (for example, your organization blocks unsafe attachments and keeps Office fully updated), the exposure is lower; otherwise, treat this as a realistic email-attachment risk.

This is urgent because attackers can use a crafted Excel file to execute code on a local machine when it’s opened. While no KEV listing is present and no clear dated incidents are mentioned in the provided reporting, Microsoft has released fixes and public interest is new—so prioritize updating to close this direct, user-interaction-based risk.