Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
The security feature bypassed is the macro security controls, specifically the setting that disables XL4 macros (Excel 4.0 macros).
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
The user must open the malicious workbook, enable editing, and then click the attacker‑supplied Quick Access Toolbar (QAT) button, which triggers the XL4 macro despite Trust Center protections.
Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
Security updates
https — https://docs.microsoft.com/en-us/officeupdates/office365-proplus-security-updates
16.105.26011018 — https://go.microsoft.com/fwlink/p/?linkid=831049
Vulnerabilities 1
-
High 7.8
Microsoft Excel Security Feature Bypass Vulnerability
Improper access control in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally.
Revision history
-
#1
Information published.
References
-
CVE-2026-20949 Microsoft Excel Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20949
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss