MSRC-CVE-2026-26144 — Microsoft Excel Information Disclosure Vulnerability

Summary

Impact: Information Disclosure. Microsoft rating: Critical. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

Details

Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.

What type of information could be disclosed by this vulnerability?
An attacker who successfully exploited this vulnerability could potentially cause Copilot Agent mode to exfiltrate data via unintended network egress, enabling zero-click information disclosure attack

Security updates
https — https://docs.microsoft.com/en-us/officeupdates/office365-proplus-security-updates

Vulnerabilities 1

High 7.5

CVE-2026-26144

Microsoft Excel Information Disclosure Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Microsoft Microsoft 365 Apps for Enterprise

Mar 10, 2026

Revision history

2026-03-10 #1
Information published.

References

CVE-2026-26144 Microsoft Excel Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26144
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss