Microsoft Office Remote Code Execution Vulnerability

3.28% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

• Microsoft Microsoft SharePoint Enterprise Server 2016
• Microsoft Microsoft SharePoint Enterprise Server 2013 Service Pack 1
• Microsoft Microsoft SharePoint Server 2019
• Microsoft Microsoft Office 2019
• Microsoft Microsoft Office 2019 for Mac
• Microsoft Microsoft Office Online Server
• Microsoft Microsoft 365 Apps for Enterprise
• Microsoft Microsoft Office LTSC for Mac 2021
• Microsoft Microsoft Office LTSC 2021
• Microsoft Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server Subscription Edition Language Pack
• Microsoft Microsoft Excel 2016
• Microsoft Microsoft Office 2016
• Microsoft Microsoft Excel 2013 Service Pack 1
• Microsoft Microsoft Office 2013 Service Pack 1
• Microsoft Microsoft Office Web Apps Server 2013 Service Pack 1
• Microsoft Microsoft SharePoint Foundation 2013 Service Pack 1

• msrc.microsoft.com /update-guide/vulnerability/CVE-2022-21840

  vendor-advisory

• portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2022-21840

• CVE List CVE-2022-21840
• NVD CVE-2022-21840

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.