The important distinction for users: this is not a Preview Pane attack. Microsoft says an attacker must send someone a malicious Office file and persuade them to open it. For administrators, the practical response is to match each installed Office product to its specific remediation—not treat the entire estate as one interchangeable update target.
Severity and exploitation assessment
Microsoft’s security advisory supplies these details:
| Field | Advisory value |
|---|---|
| CVE | CVE-2026-105718 |
| Exact title | Microsoft Excel Remote Code Execution Vulnerability |
| Severity | Critical |
| CVSS base score | 8.8 |
| CVSS temporal score | 7.7 |
| Weakness identifiers | CWE-125, CWE-20 |
| Exploitation assessment | Exploitation Less Likely |
Publicly disclosed: No
Exploited: No
Customer action required: Yes
The supplied CVSS vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
The vector describes a network attack with low attack complexity, no privileges required, and required user interaction. It records unchanged scope and high impacts to confidentiality, integrity, and availability.
“Exploitation Less Likely” is Microsoft’s assessment, not a reason to skip remediation. The Critical severity and the required customer action remain relevant even though Microsoft records no exploitation.
Opening the file is the key interaction
Microsoft explicitly explains the UI:R metric: an attacker must deliver a malicious Office file and convince the recipient to open it. The advisory also explicitly rules out the Preview Pane as an attack vector for this vulnerability.
That distinction helps keep user messaging accurate. Simply previewing a file is not the attack path described here; opening an attacker-supplied file is. Organizations should therefore pair patch deployment with a focused reminder to treat unexpected Office files cautiously.
The advisory also describes the issue under the wording “Microsoft Office Excel Remote Code Execution Vulnerability”, identifying the same out-of-bounds read and unauthorized network code-execution consequence. Its scope extends beyond a single desktop edition, so remediation planning needs to account for all affected products below.
Affected products and exact remediation targets
Microsoft supplies separate targets for the listed Office product families. The following preserves its remediation values exactly; the Microsoft 365 Apps release reference is shown as literal text.
Microsoft 365 Apps for Enterprise
For Microsoft 365 Apps for Enterprise for 32-bit Systems (x86), update to fixed build [Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn](https://aka.ms/OfficeSecurityReleases) or later.
For Microsoft 365 Apps for Enterprise for 64-bit Systems (x64), update to fixed build [Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn](https://aka.ms/OfficeSecurityReleases) or later.Office LTSC on Windows
- For Microsoft Office LTSC 2021 for 32-bit editions (x86), update to fixed build 16.0.14334.20974 or later.
- For Microsoft Office LTSC 2021 for 64-bit editions (x64), update to fixed build 16.0.14334.20974 or later.
- For Microsoft Office LTSC 2024 for 32-bit editions (x86), update to fixed build 16.0.17932.21056 or later.
- For Microsoft Office LTSC 2024 for 64-bit editions (x64), update to fixed build 16.0.17932.21056 or later.
Office on Mac
- For Microsoft Office 365 for Mac, update to fixed build 16.114.26101123 or later.
- For Microsoft Office LTSC for Mac 2021, update to fixed build 16.114.26101123 or later.
- For Microsoft Office LTSC for Mac 2024, update to fixed build 16.114.26101123 or later.
Microsoft’s advisory states that, as of October 15, 2025, security updates for Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Microsoft Office 365 for Mac are available. It instructs customers running those products to ensure the update is installed to be protected from this vulnerability.
Office Online Server
- For Office Online Server, install KB5002928 to reach fixed build 16.0.10417.20228.
That establishes the explicit server mapping: KB5002928 → 16.0.10417.20228.
What the update mappings mean for administrators
Comparing Microsoft’s supplied targets reveals a useful deployment distinction: the two architectures share a fixed build within each Windows LTSC release, but LTSC 2021 and LTSC 2024 have different targets. Meanwhile, all three listed Mac products share the same fixed build. Office Online Server has its own KB and build requirement.
The operational implication is straightforward: compliance should be evaluated against the installed product family, not a single organization-wide Office build number.
A practical remediation checklist follows from those mappings:
- Separate the inventory by product and architecture. Include affected Mac installations and Office Online Server alongside desktop applications.
- Assign the matching remediation target. Keep the two Windows LTSC release targets distinct and use Microsoft’s supplied security-release reference for Microsoft 365 Apps.
- Verify the installed result. Confirm that each deployment reaches its applicable fixed build or later, with Office Online Server checked against its specific KB-to-build mapping.
- Keep file-handling guidance precise. Warn about opening malicious Office files without incorrectly describing the Preview Pane as vulnerable.
The bottom line: user interaction is required, but patching is still required too. The strongest response combines accurate user guidance with product-specific deployment verification—because sending an update and confirming protection are two different jobs.