DE | EN
News November 11, 2026

Critical Office flaws allow privilege escalation

Several critical vulnerabilities in Microsoft Office products can be exploited for privilege escalation, code execution, security bypasses, spoofing, and data disclosure. The advisory also warns that stolen NTLMv2 hashes could enable attackers to authenticate as affected users.

Critical Office flaws allow privilege escalation

Key points

  • The advisory covers Office Online Server, Microsoft 365 Apps, Office, Office LTSC 2021, SharePoint, Teams, Office LTSC 2024, and Office 365.
  • Successful exploitation could enable elevated permissions, arbitrary code execution, bypasses of security controls, spoofing, and exposure of sensitive information.
  • Disclosure of a user's NTLMv2 hash may allow an attacker to authenticate as that user.

Context

The vulnerabilities affect a broad range of Microsoft Office and collaboration products, including cloud services, long-term-support editions, SharePoint, and Teams. Their combined impact includes serious risks for enterprise identities, administrative privileges, and confidential data.

What this means for you

Directly applicable

Developers and technical decision-makers can use the advisory to identify affected Microsoft deployments and assess risks involving privileges, code execution, identity hashes, and sensitive data.

Who benefits: Developers and technical decision-makers maintaining Microsoft-based enterprise environments benefit from a clear scope of affected products and a basis for targeted security reviews.

Share article:

Does a report affect your system?

Send the link to the report and two sentences about your system. You get an assessment of whether action is needed and what the fix looks like.

Get an assessment