Cyber Posture

CVE-2026-26144

High

Published: 10 March 2026

Published
10 March 2026
Modified
13 March 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0010 27.8th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-26144 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Microsoft 365 Apps. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-79

Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.

addresses: CWE-79

Validates web inputs to reject script-related content that could produce XSS.

addresses: CWE-79

Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Why these techniques?

Remote network-accessible XSS (CWE-79) in Excel's web page generation directly maps to exploitation of a (web) application (T1190) and arbitrary JavaScript execution (T1059.007); the stated high-impact information disclosure enables data collection from the local system/browser context (T1005).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Deeper analysisAI

CVE-2026-26144, published on 2026-03-10, is a cross-site scripting (XSS) vulnerability classified under CWE-79 in Microsoft Office Excel. The issue arises from improper neutralization of input during web page generation, enabling an unauthorized attacker to disclose information over a network. It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity due to network accessibility, low attack complexity, and no requirements for privileges or user interaction.

An unauthorized attacker can exploit this vulnerability remotely without authentication or user involvement. Exploitation allows the attacker to achieve high-impact information disclosure over the network, potentially exposing sensitive data contained in or accessible via the affected Excel component, while leaving integrity and availability unaffected.

The Microsoft Security Response Center advisory provides details on mitigation and patches at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26144.

Details

CWE(s)

Affected Products

microsoft
365 apps
all versions

CVEs Like This One

CVE-2025-62210Same vendor: Microsoft
CVE-2025-62459Same vendor: Microsoft
CVE-2025-62211Same vendor: Microsoft
CVE-2026-21264Same vendor: Microsoft
CVE-2026-26105Same vendor: Microsoft
CVE-2025-24077Same product: Microsoft 365 Apps
CVE-2025-21363Same product: Microsoft 365 Apps
CVE-2026-20956Same product: Microsoft 365 Apps
CVE-2026-20944Same product: Microsoft 365 Apps
CVE-2026-21514Same product: Microsoft 365 Apps

References