CVE-2026-26144

—

CVSS 3.1

4.7 medium

EPSS

1%p67

Published

Mar 10, 2026 (Mar 10, 2026)

Modified

Jun 17, 2026

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Vendors: microsoft
Products: 365 apps
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news4 stories

Microsoft patches 80+ vulnerabilities, six flagged as "more likely" to be exploited

Help Net SecurityMar 19, 10:31 UTC · Mar 19, 2026Vulnerability in the wildCVE-2026-21262 CVE-2026-26127 CVE-2026-24289+10 CVEs

Microsoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero

The Hacker NewsMar 11, 09:15 UTC · Mar 11, 2026Vulnerability CVE-2026-26127 CVE-2026-21262 CVE-2026-21536+3 CVEs

Microsoft Patch Tuesday for March 2026 — Snort rules and prominent vulnerabilities

Cisco TalosMar 10, 22:23 UTC · Mar 10, 2026Vulnerability CVE-2026-26110 CVE-2026-26113 CVE-2026-26144+14 CVEs

Microsoft’s monthly Patch Tuesday is first in 6 months with no actively exploited zero

CyberScoopMar 10, 19:37 UTC · Mar 10, 2026Vulnerability in the wildCVE-2026-21262 CVE-2026-26127 CVE-2026-23668+8 CVEs