CVE-2026-97740

Analyzed Analyzed - Analysis Complete

Exposure of Sensitive Information in Microsoft Office Excel

Publication date: 2026-10-13

Last updated on: 2026-10-15

Assigner: Microsoft Corporation

Description

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-97740

EUVD

EUVD-2026-99812

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	365_apps	*
microsoft	365_apps	*
microsoft	microsoft_365	*
microsoft	office_2021	*
microsoft	office_2021	*
microsoft	office_2021	*
microsoft	office_2024	*
microsoft	office_2024	*
microsoft	office_2024	*
microsoft	office_online_server	to 16.0.10417.20228 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-497	The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Attack-Flow Graph

Executive Summary

This vulnerability in Microsoft Office Excel allows an unauthorized attacker to access sensitive system information over a network. It involves exposure of data to an unauthorized control sphere, meaning information could be disclosed without proper authorization.

Detection Guidance

This vulnerability involves information disclosure in Microsoft Office Excel. Detection primarily relies on monitoring network traffic and system logs for unusual Excel file interactions or data exfiltration attempts. Check for unauthorized access to sensitive files or unexpected network connections originating from Excel processes.

Impact Analysis

An attacker could exploit this to steal sensitive data, such as confidential files or system details, potentially leading to data breaches or further attacks. Users of affected Microsoft Office Excel versions are at risk of information disclosure.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if sensitive personal or health data is exposed. Organizations may face legal penalties, fines, or reputational damage due to unauthorized data disclosure.

Mitigation Strategies

Apply the latest security updates from Microsoft for Office Excel and related products. Monitor Microsoft's security advisories for patches and disable macros or external content if not required.

Hi! I’m here to help you understand CVE-2026-97740. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70