Product:
Microsoft Office Excel
Summary
Improper neutralization of input during web page generation in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. This vulnerability can lead to significant confidentiality impacts. Attackers can exploit this flaw to gain unauthorized access to sensitive information.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2026-26144 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious web page that, when accessed by a user with Microsoft Office Excel, triggers the improper handling of input. This can lead to the execution of cross-site scripting attacks, allowing the attacker to extract sensitive information from the user’s session or environment.
Affected Products
- Microsoft Office Excel: A widely used spreadsheet application that is vulnerable to cross-site scripting attacks due to improper input handling.
Mitigation
To mitigate this vulnerability, users should ensure that they are using the latest version of Microsoft Office Excel and apply any available security updates. Additionally, users should be cautious when clicking on links or accessing web pages from untrusted sources.