Nov 2026: Microsoft Office Security Feature Bypass Vulnerability
CVE-2026-119998 Published on November 10, 2026
Microsoft Office Security Feature Bypass Vulnerability
Product ui does not warn user of unsafe actions in Microsoft Office allows an unauthorized attacker to bypass a security feature over a network.
Vulnerability Analysis
Weakness Type
Product UI does not Warn User of Unsafe Actions
The software's user interface does not warn the user before undertaking an unsafe action on behalf of that user. This makes it easier for attackers to trick users into inflicting damage to their system. Software systems should warn users that a potentially dangerous action may occur if the user proceeds. For example, if the user downloads a file from an unknown source and attempts to execute the file on their machine, then the application's GUI can indicate that the file is unsafe.
Products Associated with CVE-2026-119998
Want to know whenever a new CVE is published for Microsoft products? stack.watch will email you.
Affected Versions
Microsoft 365 Apps for Enterprise:- Version 16.0.1 and below https://aka.ms/OfficeSecurityReleases is affected.
- Version 16.0.1 and below 16.0.14334.21048 is affected.
- Version 16.0.0 and below 16.0.17932.21140 is affected.