NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

CVE-2026-26144

CVSS 3.1: 4.7 medium
EPSS: 1%p67
Published: Mar 10, 2026 · Mar 10, 2026
Modified: Jun 17, 2026

Analyze CVE-2026-26144 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Vendors: microsoft

Products: 365 apps

Weakness: CWE-79

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news

4 stories

Microsoft patches 80+ vulnerabilities, six flagged as "more likely" to be exploited

Help Net SecurityMar 19, 10:31 UTC · Mar 19, 2026VulnerabilityExploitedCVE-2026-21262 CVE-2026-26127 CVE-2026-24289+101

60

Microsoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero

The Hacker NewsMar 11, 09:15 UTC · Mar 11, 2026VulnerabilityCVE-2026-26127 CVE-2026-21262 CVE-2026-21536+34 · 2 reads

60

Microsoft Patch Tuesday for March 2026 — Snort rules and prominent vulnerabilities

Cisco TalosMar 10, 22:23 UTC · Mar 10, 2026VulnerabilityCVE-2026-26110 CVE-2026-26113 CVE-2026-26144+142 · 1 read

60

Microsoft’s monthly Patch Tuesday is first in 6 months with no actively exploited zero

CyberScoopMar 10, 19:37 UTC · Mar 10, 2026VulnerabilityExploitedCVE-2026-21262 CVE-2026-26127 CVE-2026-23668+82

60