Microsoft Microsoft Office LTSC 2024 for 64-bit editions
productNLA product tracked in the threat graph; the vulnerabilities below are known to affect it.
by severity
15critical237high165medium6low
updated 2026-10-30
01
vulnerabilities (773)
Related CVEs.
| ID | severity | exploitable | ||||
|---|---|---|---|---|---|---|
| CVE-2026-21509US | —OT critical | KEV | ||||
Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally. | ||||||
| CVE-2026-55040US | —OT critical | KEV | ||||
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. | ||||||
| CVE-2026-32201US | medium6.5OT critical | KEV | ||||
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | ||||||
| CVE-2026-65660US | high8.8OT critical | KEV | ||||
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-50522US | —OT critical | KEV | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | ||||||
| CVE-2026-21514US | —OT critical | KEV | ||||
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. | ||||||
| CVE-2026-56164US | critical9.8OT critical | KEV | ||||
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. | ||||||
| CVE-2026-20963US | —OT critical | KEV | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | ||||||
| CVE-2026-58644US | —OT critical | KEV | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | ||||||
| CVE-2026-96951US | high8.8OT critical | KEV | ||||
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. | ||||||
| CVE-2026-26114US | — | Exploit | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-63520US | — | Exploit | ||||
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | ||||||
| CVE-2026-45484US | — | — | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | ||||||
| CVE-2026-33112US | — | — | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-20945US | medium5.4 | — | ||||
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network… | ||||||
| CVE-2026-20947US | — | — | ||||
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-20959US | medium5.4 | — | ||||
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network… | ||||||
| CVE-2025-60724US | — | — | ||||
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. | ||||||
| CVE-2026-40364US | — | — | ||||
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||||
| CVE-2026-21511US | — | — | ||||
Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. | ||||||
| CVE-2025-62204US | — | — | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-66808US | — | — | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-66805US | — | — | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-65663US | — | — | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-65658US | — | — | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-64901US | — | — | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-63514US | — | — | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-35439US | — | — | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-33110US | — | — | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-63516US | — | — | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | ||||||
| CVE-2026-40368US | — | — | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-40357US | — | — | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-70321US | — | — | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-65665US | — | — | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-50515US | — | — | ||||
Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network. | ||||||
| CVE-2025-21364US | — | — | ||||
Microsoft Excel Security Feature Bypass Vulnerability | ||||||
| CVE-2026-45454US | high8.8 | — | ||||
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-70242US | critical9.8 | — | ||||
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||||
| CVE-2026-21260US | — | — | ||||
Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. | ||||||
| CVE-2026-85900US | high8.8 | — | ||||
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-26106US | — | — | ||||
Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||||
| CVE-2026-70291US | critical9.8 | — | ||||
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||||
| CVE-2026-81385US | high8.8 | — | ||||
Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network. | ||||||
| CVE-2026-26144US | medium4.7 | — | ||||
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Excel allows an unauthorized attacker to disclose information over a networ… | ||||||
| CVE-2026-42835US | — | — | ||||
Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker to disclose informat… | ||||||
| CVE-2026-70298US | medium6.5 | — | ||||
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | ||||||
| CVE-2026-26105US | critical9.3 | — | ||||
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a netwo… | ||||||
| CVE-2026-62837US | — | — | ||||
Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | ||||||
| CVE-2026-97749US | critical9.8 | — | ||||
Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||||
| CVE-2025-21186US | — | — | ||||
Microsoft Access Remote Code Execution Vulnerability | ||||||
showing 50 of 773
02
weaknesses (8)
The flaw types (CWEs) most of these CVEs share.
- CWE-122Heap-based Buffer Overflow192 CVEs
- CWE-125Out-of-bounds Read132 CVEs
- CWE-416Use After Free109 CVEs
- CWE-79Improper Neutralization of Input During Web Page Generation55 CVEs
- CWE-121Stack-based Buffer Overflow38 CVEs
- CWE-20Improper Input Validation31 CVEs
- CWE-822Untrusted Pointer Dereference29 CVEs
- CWE-190Integer Overflow or Wraparound27 CVEs
03
sources (2)
Which sources assert this record, and when.
- NLNCSC-NL (CSAF)667 CVEs
- USMicrosoft MSRC (CSAF)551 CVEs
scry
Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.
Free scan