Product UI does not warn user of unsafe actions in Microsoft Office - CVE-2026-119998

Vulnerability details

The vulnerability allows a remote attacker to bypass Office Protected View and cause documents to open in editing mode rather than protected mode.

The vulnerability exists due to missing warnings about unsafe actions in the Microsoft Office user interface when opening documents. A remote attacker can induce a user to open a document without the expected security warning to bypass Office Protected View.

The Preview Pane is not an attack vector for this vulnerability.

Affected software

How to mitigate CVE-2026-119998

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-119998
• https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office