CVE-2026-26144

CVE Enrichment

CVSS: 4.7 MEDIUM
EPSS: 1.39%
EPSS Percentile: 72.35%
CISA KEV: Not listed

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 11-Mar-2026 01:18
Last Modified: 17-Jun-2026 17:25
EPSS Date: 2026-11-05
CWE: CWE-79

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:C /
                            C:L /
                            I:N /
                            A:N

CNA Products / Version Status

Microsoft · Microsoft 365 Apps for Enterprise Source: CNA · [email protected]
Default status: unknown

16.0.1 ≤ version < https://aka.ms/OfficeSecurityReleases — affected (custom)

Platforms: 32-bit Systems, x64-based Systems

Affected Products / Versions

microsoft / 365_apps Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*
microsoft / 365_apps Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*

References

[email protected]

Last enrichment sync: 05-Nov-2026 23:13
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (4)

Microsoft patched CVE-2026-26144, a cross-site scripting flaw in Excel that chains to Copilot Agent and enables silent, clickless exfiltration of spreadsheet data to attacker-controlled endpoints. Excel XSS Could Let Copilot Agent Exfiltrate Spreadsheet Data, Opinion Warns
Tracked as CVE-2026-26144 (CVSS score of 7.5), it has been described as a case of cross-site scripting that occurs as a result of improper neutralization of input during web page generation. Microsoft Patches 84 Vulnerabilities in May 2026 Update, Including Two Publicly Disclosed Zero-Days
Notable fixes include CVE-2026-21262 (SQL Server privilege escalation) and CVE-2026-26144 (Excel Copilot zero-click information disclosure), and administrators are urged to apply updates immediately to mitigate remote Microsoft’s March 2026 Patch Tuesday Fixes 79 Vulnerabilities, Including Two Disclosed Zero-Days
Two Office RCEs (CVE-2026-26110 and CVE-2026-26113) are exploitable via the preview pane, and an Excel bug (CVE-2026-26144) could enable Copilot-based data exfiltration. Microsoft’s March 2026 Patch Tuesday Fixes 79 Flaws, Including Two Publicly Disclosed Zero-Days

CVE (9)

People (6)

MITRE ATT&CK (2)

Vendors (7)

Products (19)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.