CVE-2026-69778

CVE-2026-69778 is a heap-based buffer overflow (CWE-122) in Microsoft Access, the database application bundled with Microsoft Office and Microsoft 365. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates the flaw is reachable over a network without special privileges but requires user interaction, most likely by convincing a user to open a maliciously crafted Access database file. Successful exploitation allows an unauthorized attacker to execute arbitrary code in the context of the user, with high impact on confidentiality, integrity, and availability (CVSS 8.8). Any user running Microsoft Access via supported Office or Microsoft 365 installations is affected. There is currently no known public proof-of-concept, the flaw is not in the CISA KEV catalog, and EPSS assigns only a 0.8% probability of exploitation in the next 30 days.

What to do: Apply Microsoft's security update for Access as soon as it is published through Microsoft's standard update channels (Microsoft Update, WSUS, or your endpoint management platform); specific patched build numbers are not listed in the available data. Until systems are patched, avoid opening .accdb/.mdb files from untrusted sources and remind users, since exploitation requires user interaction. Inventory your estate for Access deployments (e.g., Office Professional installs and Microsoft 365 E3/E5 seats) to prioritize patching.