CVE-2026-45456Patch(microsoft / 365_apps)

LOWCVSS 8.4 · HIGH

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

Patch microsoft 365_apps systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

microsoft CVEs Back to dashboard

2.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45456

Weakness type (CWE)

CWE-843

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

365_apps
microsoft_365
office_2016
office_2019

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
5 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 3 signals
Technical details provided in 5 signals
Disclosure: 1 classified signal
Peaked 1d ago at 2 mentions (2026-06-12); latest day: 2
5 total mentions across 3 days

Affected systems

Vendors

microsoft

Products

365_appsmicrosoft_365office_2016office_2019office_2021office_2024sharepoint_server

3 versions affected across 7 products

Deep dive

Activity timeline5 mentions / 3d

Signal classification3 categories

Patch

360.0%

Disclosure

120.0%

PoC

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-09	1	Patch1
2026-06-12	2	Disclosure1Patch1
2026-06-13	2	Patch1PoC1

Full discourse5 posts

Cyber Edition@CyberEdition133d
Patch
⚠️ Microsoft patched 3 critical Outlook and Word RCE flaws (CVE-2026-45456, CVE-2026-45458, CVE-2026-47635). Even Outlook’s Preview Pane can trigger exploitation without opening an attachment. Organizations should patch immediately. #Microsoft https://thecyberedition.com/critical-microsoft-outlook-word-rce-flaws-patch-now/
Post summary
Microsoft has released patches for three critical Outlook and Word remote‑code‑execution flaws; organizations should apply the updates promptly since the Preview Pane can trigger exploitation without opening attachments.
0001086
736 followersView on X
ThreatAft@ThreatAft133d
PoC
🔐 CRITICAL: Outlook & Word RCE zero‑days Preview Pane = attack vector. No click required. Just previewing an email triggers code execution. CVE-2026-47635, CVE-2026-45458, CVE-2026-45456 — CVSS 8.4 🔗 https://threataft.com/articles/outlook-word-preview-pane-rce-cve-2026-47635-45458 #CyberSecurity #ThreatIntel #infosec #PatchTuesday
Post summary
The article announces critical Outlook & Word RCE vulnerabilities triggered by preview pane access, links to a PoC, but offers no evidence of active exploitation, patches, or false‑positive claims.
0000156
29 followersView on X
The Daily Tech Feed@dailytechonx134d
Patch
Microsoft has patched critical RCE vulnerabilities in Outlook and Word, identified as CVE-2026-45456, CVE-2026-45458, and CVE-2026-47635. These flaws could allow attackers to execute arbitrary code via specially crafted emails. Users should update their Office installations immediately to mitigate potential risks. #Microsoft #Outlook #Word #RCE #CyberSecurity #Vulnerabilities https://thedailytechfeed.com/critical-vulnerabilities-in-microsoft-outlook-and-word-allow-remote-code-execution/
Post summary
Microsoft announced patches for three critical RCE CVEs affecting Outlook and Word, urging users to update Office promptly to avoid potential exploitation.
0000040
389 followersView on X
ThreatCluster@threatcluster134d
Disclosure
Microsoft disclosed three high-severity remote code execution bugs in Outlook and Word, CVE-2026-45456, CVE-2026-45458 and CVE-2026-47635, each rated CVSS 8.4, in a 9 June security advisory, Microsoft said. https://threatcluster.io/cluster/critical-rce-vulnerabilities-found-in-microsoft-outlook-and--0ac29809
Post summary
Microsoft disclosed three high‑severity RCE vulnerabilities in Outlook and Word (CVE‑2026‑45456, CVE‑2026‑45458, CVE‑2026‑47635, CVSS 8.4); the advisory supplies the CVEs and severity ratings but provides no PoC, exploit, active exploitation evidence, or patch details.
0000055
330 followersView on X
WindowsForum@windowsforum137d
Patch
🪟 Microsoft: “It’s RCE remotely!” but CVSS says “Local.” Translation: the attacker hangs out remote, your PC does the heavy lifting. Either way, patch it—words can weaponize. #Windows #Microsoft #Outlook #Word #CVE https://windowsforum.com/threads/cve-2026-45456-remote-code-execution-with-cvss-av-l-in-outlook-and-word.424271/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #OutlookSecurity #OfficeVulnerability https://t.co/fxGgwY2HDJ
Post summary
The message highlights a mismatch between Microsoft’s report of remote RCE for CVE‑2026‑45456 and the CVSS local rating, while urging users to patch the vulnerability promptly.
0000038
1.2K followersView on X

CPE platform detail16 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

16 of 16 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	microsoft	365_apps	-	-	x64
App	microsoft	365_apps	-	-	x86
App	microsoft	microsoft_365	-	macos	-
App	microsoft	office_2016	-	-	x64
App	microsoft	office_2016	-	-	x86
App	microsoft	office_2019	-	-	x64
App	microsoft	office_2019	-	-	x86
App	microsoft	office_2021	-	-	x64
App	microsoft	office_2021	-	-	x86
App	microsoft	office_2021	-	macos	-
App	microsoft	office_2024	-	-	x64
App	microsoft	office_2024	-	-	x86
App	microsoft	office_2024	-	macos	-
App	microsoft	sharepoint_server	-	-	-
App	microsoft	sharepoint_server	2016	-	-
App	microsoft	sharepoint_server	2019	-	-

Explore more

Back to dashboard microsoft CVEs 365_apps vulnerabilities

What researchers are saying

CVE-2026-45456

Cyber Edition[verified]@CyberEditionPatch

Microsoft has released patches for three critical Outlook and Word remote‑code‑execution flaws; organizations should apply the updates promptly since the Preview Pane can trigger exploitation without opening attachments.

The Daily Tech Feed[verified]@dailytechonxPatch

Microsoft announced patches for three critical RCE CVEs affecting Outlook and Word, urging users to update Office promptly to avoid potential exploitation.

ThreatCluster[verified]@threatclusterDisclosure

Microsoft disclosed three high‑severity RCE vulnerabilities in Outlook and Word (CVE‑2026‑45456, CVE‑2026‑45458, CVE‑2026‑47635, CVSS 8.4); the advisory supplies the CVEs and severity ratings but provides no PoC, exploit, active exploitation evidence, or patch details.

WindowsForum[verified]@windowsforumPatch

The message highlights a mismatch between Microsoft’s report of remote RCE for CVE‑2026‑45456 and the CVSS local rating, while urging users to patch the vulnerability promptly.

ThreatAft@ThreatAftPoC

The article announces critical Outlook & Word RCE vulnerabilities triggered by preview pane access, links to a PoC, but offers no evidence of active exploitation, patches, or false‑positive claims.