CVE-2026-81394

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Scoring

Severity

MEDIUM

CVSS base score

5.5

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

CWE

CWE-497

Published

2026-09-08

Last modified

2026-09-09

Affected products

• Microsoft Microsoft 365 Apps for Enterprise
• Microsoft Microsoft Excel 2016
• Microsoft Microsoft Office 2016
• Microsoft Microsoft Office 2019
• Microsoft Microsoft Office 365 for Mac
• Microsoft Microsoft Office LTSC 2021
• Microsoft Microsoft Office LTSC 2024
• Microsoft Microsoft Office LTSC for Mac 2021

Weakness type

• CWE-497

Related vulnerabilities

• CVE-2026-81387 — Microsoft Excel Information Disclosure Vulnerability
• CVE-2026-69315 — Windows License Manager Information Disclosure Vulnerability
• CVE-2026-68842 — Windows MIDI Service Module Information Disclosure Vulnerability
• CVE-2026-71330 — Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability
• CVE-2026-69832 — Win32k Information Disclosure Vulnerability
• CVE-2026-69723 — Windows Kernel Information Disclosure Vulnerability
• CVE-2026-69406 — Windows Kernel Information Disclosure Vulnerability
• CVE-2026-69339 — Windows MIDI Service Module Information Disclosure Vulnerability

Markdown version · Browse all CVEs