Microsoft’s own Office security release notes place CVE-2026-68807 in the Excel section of the August 11 release, alongside 26 other Excel CVEs. The affected software list is broader than a single Microsoft 365 channel: Microsoft published corresponding security builds for Microsoft 365 Apps, Office 2024, Office LTSC 2024, Office LTSC 2021, Office 2021, and—despite its end of support—Office 2019.
The practical message is straightforward: organizations that allow users to open externally supplied spreadsheets should move their supported Office deployment to the August 11 security build for its update channel. What is not established publicly is whether CVE-2026-68807 involves a malformed workbook, an embedded object, a formula feature, a preview path, or another Excel component—and that missing information limits the value of broad “RCE” headlines.
Microsoft has confirmed the patch, but not the attack path
Microsoft published CVE-2026-68807 on August 11, 2026, identifying it as a Microsoft Excel remote code execution vulnerability. Its Office security release notes independently corroborate that association by listing the CVE under Excel rather than under the wider Office suite.
That confirmation matters, but it should not be stretched beyond the record. Microsoft’s publicly accessible advisory page does not currently expose a vulnerability description, CVSS score, weakness classification, attack vector, affected-build range, or exploitability assessment without the JavaScript-driven Security Update Guide interface. The supplied record’s generic explanation of confidence in vulnerability reports describes a CVSS reporting-confidence concept; it does not itself state the confidence value assigned to CVE-2026-68807.
There is also no publicly indexed CVE Program or NIST National Vulnerability Database entry for CVE-2026-68807 as of August 12. That is not unusual one day after a Patch Tuesday disclosure, particularly during a release with hundreds of CVEs, but it means defenders cannot yet rely on those databases for independently normalized affected-product data or severity scoring.
Most importantly, there is no public indication from Microsoft, CISA, NVD, the CVE Program, or independent security researchers that CVE-2026-68807 is being exploited in the wild. There is likewise no published proof of concept. The absence of those signals does not lower the need to patch; it means the correct priority is routine but prompt remediation, rather than emergency incident-response treatment.
The August release contains 27 Excel CVEs
CVE-2026-68807 is easy to miss because Microsoft’s August Office release notes contain an unusually dense Excel tranche. The Excel section names 27 CVEs in total, including CVE-2026-65807, CVE-2026-68793 through CVE-2026-68808, CVE-2026-68810 through CVE-2026-68817, and CVE-2026-70327 and CVE-2026-70328.
That concentration changes the operational decision. Even if an organization later determines that CVE-2026-68807 is not relevant to one specific workflow, holding the August Office update leaves a substantial set of Excel fixes unapplied. The prudent unit of remediation is the Office security build, not one CVE.
Microsoft separates closely numbered entries across application families in the same release. CVE-2026-68809 appears under PowerPoint, while CVE-2026-68792 and CVE-2026-68818 appear under the Office suite section. That separation is a reminder not to assume that every CVE in the 687xx and 688xx cluster shares a root cause, file format, or mitigation.
The numbering pattern also creates a reporting trap. A vulnerability title containing “remote code execution” does not mean an attacker can connect to an Excel installation over the network and run code without user involvement. In Microsoft’s vulnerability naming, the phrase commonly describes the outcome—execution of attacker-controlled code on the victim’s system—rather than a confirmed network attack vector. Until Microsoft publishes the technical description and CVSS vector, administrators should not claim that this is zero-click, Preview Pane-triggered, email-delivered, macro-dependent, or exploitable through SharePoint and OneDrive previews.
The patched Office builds are already identifiable
Microsoft’s August 11 Office security release notes provide concrete build targets for Click-to-Run deployments. For the mainstream desktop channels, the relevant security builds are:
- Current Channel is Version 2607, Build 20228.20190.
- Monthly Enterprise Channel is Version 2607, Build 20228.20188; Version 2606, Build 20131.20206; and Version 2605, Build 20026.20266.
- Semi-Annual Enterprise Channel is Version 2508, Build 19127.20730, while the Semi-Annual Enterprise Channel build receiving Monthly Enterprise Channel updates is Version 2607, Build 20228.20186.
- Office 2024 Retail and Office 2021 Retail are Version 2607, Build 20228.20190.
- Office LTSC 2024 Volume Licensed is Version 2408, Build 17932.20910, and Office LTSC 2021 Volume Licensed is Version 2108, Build 14334.20848.
- Office 2019 Volume Licensed is Version 1808, Build 10417.20197.
For a managed Windows estate, those build numbers are more useful than a generic statement that devices are “up to date.” Inventory systems should identify the installed Click-to-Run channel and compare the Excel version against the appropriate August 11 target. A device on a lower build may simply be waiting for a staged deployment ring, but it remains unpatched for this release until the Office update is actually installed.
The Office security notes state that they apply to Microsoft 365 Apps for enterprise and business, Office 2019, Office LTSC 2021, Office 2021, Office LTSC 2024, and Office 2024. They do not establish that every product ever branded “Excel” is affected by CVE-2026-68807. In particular, administrators should not infer coverage for Excel 2016, Office Online Server, Excel for the web, or macOS editions solely from this Windows-oriented build list.
Office 2019’s presence should not be mistaken for renewed support
The Office 2019 entry deserves attention because Microsoft ended support for Office 2019 on October 14, 2025. Microsoft’s release notes explicitly say it may choose, at its sole discretion, to issue one or more updates after that date. The August 11 build proves that the company did issue an update this month; it does not reverse Office 2019’s end-of-support status or create a dependable future patch commitment.
That distinction has a direct planning consequence. An organization still running Office 2019 should deploy Build 10417.20197 where available, then treat the patch as short-term risk reduction while finishing its migration to a supported Office release. Waiting for the next emergency spreadsheet flaw and assuming Office 2019 will again receive a discretionary update is not a defensible lifecycle strategy.
Office 2016 reached end of support on the same October 14, 2025 date and is not included in Microsoft’s August 11 Office security build list. That absence does not prove CVE-2026-68807 affects Office 2016, nor does it prove the product is safe. It means the current release record offers no basis for treating an Office 2016 installation as covered.
File-handling controls remain useful, but they are not a substitute for the update
Organizations should keep their normal document defenses in place while deployment proceeds: block Office macros from internet-origin files, enforce Mark of the Web handling, restrict executable content in email gateways, and limit who can download files from unmanaged collaboration links. Those controls reduce exposure to many spreadsheet attacks, particularly commodity phishing campaigns.
They should not be presented as Microsoft-approved mitigations for CVE-2026-68807. Microsoft has not publicly identified the vulnerable Excel feature or stated whether the flaw is reached before macros run, while a document is rendered in Protected View, through embedded content, or via a separate parsing operation. A macro block cannot be assumed to stop a memory-safety or parsing flaw that occurs before macro policy becomes relevant.
The immediate task for IT teams is therefore to deploy the August 11 Office security release, verify the installed Excel build by channel, and flag Office 2019 and Office 2016 systems as lifecycle exceptions. CVE-2026-68807 is confirmed as patched Excel RCE, but the public record still does not support stronger claims about its severity, exploit method, or real-world use.