CVE-2026-64918 MEDIUM

CVE-2026-64918: Microsoft Office Spoofing Vulnerability

Vendor Microsoft

Product Microsoft 365 Apps for Enterprise

Weakness CWE-522 · Insufficiently protected credentials

Published September 8, 2026

Last update September 29, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

What the vulnerability does

01Description

Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network.

Key dates

02Disclosure timeline

September 8, 2026 CVE published

September 29, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-64918 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/522.html AskarLabs — CWE-522 write-up Insufficiently Protected Credentials

Related vulnerabilities

Identifiers

CVE CVE-2026-64918

CWE CWE-522

CVSS 6.5 / MEDIUM

Affected versions

Vendor Microsoft

Product Microsoft 365 Apps for Enterprise

Affected ≥ 16.0.1 and < https://aka.ms/OfficeSecurityReleases

Vendor Microsoft

Product Microsoft Office 2016

Affected ≥ 16.0.0 and < 16.0.5569.1003

Vendor Microsoft

Product Microsoft Office 2019

Affected ≥ 19.0.0 and < https://aka.ms/OfficeSecurityReleases

Vendor Microsoft

Product Microsoft Office LTSC 2021

Affected ≥ 16.0.1 and < https://aka.ms/OfficeSecurityReleases

Vendor Microsoft

Product Microsoft Office LTSC 2024

Affected ≥ 16.0.0 and < https://aka.ms/OfficeSecurityReleases

CVE-2026-64918: Microsoft Office Spoofing Vulnerability

01Description

02Disclosure timeline

03References

04Related CVE