cve-2026-77901

CVE-2026-77901 is an Important Microsoft Office Word remote-code-execution vulnerability addressed in Microsoft's September 21, 2026 security release. It affects supported Microsoft 365 Apps, Office perpetual releases, and Office for Mac, with Word 2016 covered by KB5002923. Exploitation requires a user to open a specially crafted attacker-supplied file, but a successful attack could allow code execution. Microsoft rates exploitation as less likely while still marking customer action as required, and its MSRC advisory points to a broad Office estate rather than a single Word build. The practical takeaway for administrators is to apply the specified fixed builds or the relevant update promptly across affected Word installations.