> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Multiples vulnérabilités dans Microsoft Office (14 octobre 2026)
- URL: https://f4n6.co.uk/security-feed/multiples-vulnerabilites-dans-microsoft-office-14-octobre-2026/
- Published: 2026-10-14T17:52:03.000Z
- Updated: 2026-10-14T17:52:03.000Z
- Author: Jeff Davies
- Tags: #security-feed

## situation

## 1\. Executive summary

ANSSI's CERT-FR published advisory CERTFR-2026-AVI-1312 on 14 October 2026 covering multiple vulnerabilities in Microsoft Office, affecting Microsoft 365 Apps for Enterprise (32 and 64 bit), Office 365 for Mac, Office LTSC 2021 and LTSC 2024 (32 and 64 bit), Office LTSC for Mac 2021 and 2024, Office for Android, Office Online Server, and Outlook.com. The advisory states that CVE-2026-96951 is actively exploited, per Microsoft. No CVSS scores, severities, or CISA KEV entries were resolved for this item, so no severity rating is asserted here. EMEA financial services firms running Microsoft 365 Apps for Enterprise or Office LTSC on managed endpoints should treat this as a priority patch cycle: the actively exploited CVE is the operative risk, and the remaining CVEs in the same October 2026 Microsoft release carry remote code execution, privilege escalation, and confidentiality impacts.

## 2\. Regulatory framing

| Article                                                                         | Trigger (the fact in this item)                                                                                                                                                       | Practical impact                                                                                                                                                                                                                       |
| ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 17: ICT-related incident management process                           | CVE-2026-96951 is stated by Microsoft, via CERT-FR, to be actively exploited; exploitation against a financial entity is an ICT-related incident requiring a managed response process | Entities must be able to detect, log, classify, and respond to exploitation of this CVE through their existing incident management process; the process must cover endpoint productivity software, not only server-side infrastructure |
| DORA Art. 19: reporting of major ICT-related incidents to competent authorities | If exploitation of CVE-2026-96951 meets the entity's major-incident classification under Art. 18, initial notification timelines apply                                                | Entities should pre-stage the reporting path for an endpoint-exploitation incident originating in Microsoft Office, including the evidence needed to classify it                                                                       |
| NIS2 Art. 21(2)(d): supply chain security measures                              | The affected products are Microsoft-supplied and the fix is delivered through Microsoft's update channel                                                                              | Entities should confirm that their Microsoft patch intake, testing, and deployment process covers the affected Office build channels (M365 Apps, LTSC 2021/2024, Mac, Android, Office Online Server)                                   |

No other article in the regulatory reference is engaged by the facts in this item.

## 3\. Technical analysis & attack chain

CERT-FR's advisory is a summary notice. It names the affected products, the risk categories, and one actively exploited CVE, and it points to Microsoft's update guide for the individual bulletins. It does not publish the vulnerability mechanisms, the attack vectors, or the patch details for any of the CVEs. The analysis below is limited to what the advisory states.

Affected products, as listed by CERT-FR:

- Microsoft 365 Apps for Enterprise, 32 bit and 64 bit
- Microsoft Office 365 for Mac
- Microsoft Office LTSC 2021, 32 bit and 64 bit, versions earlier than 16.0.14334.20878 and earlier than 16.0.14334.20974
- Microsoft Office LTSC 2024, 32 bit and 64 bit, versions earlier than 16.0.17932.20934 and earlier than 16.0.17932.21056
- Microsoft Office LTSC for Mac 2021 and 2024
- Microsoft Office for Android, versions earlier than 16.0.20430.20000
- Office Online Server, versions earlier than 16.0.10417.20228
- Outlook.com, versions earlier than 20260925.100

Risk categories stated by CERT-FR: remote arbitrary code execution, privilege escalation, confidentiality impact, security policy bypass, and denial of service. The advisory does not map individual CVEs to individual risk categories.

CVE-2026-96951 is stated by CERT-FR, citing Microsoft, to be actively exploited. The advisory gives no exploitation detail: no vector, no observed actor, no targeted sector, no exploitation window. Treat the exploitation status as confirmed by the vendor and the mechanism as unknown from this source.

The CVE identifiers referenced in the CERT-FR documentation section, each with a Microsoft update guide entry dated 13 October 2026, are: CVE-2026-100209, CVE-2026-100210, CVE-2026-100211, CVE-2026-100212, CVE-2026-102849, CVE-2026-102850, CVE-2026-102855, CVE-2026-102856, CVE-2026-102857, CVE-2026-102858, CVE-2026-102867, CVE-2026-105591, CVE-2026-105592, and CVE-2026-105593\. The list is truncated in the source at CVE-2026-105593; the advisory's documentation section continues beyond what was retrieved, so the full CVE set for this release is larger than the fourteen identifiers above. CVE-2026-96951, the actively exploited one, is not in that list of fourteen, which means it is documented separately in the Microsoft release.

No attack chain can be reconstructed from this source. CERT-FR does not describe initial access, exploitation steps, payload behaviour, persistence, privilege escalation mechanics, command-and-control, lateral movement, or data access for any of the CVEs. Any such description would be invention.

Confidence caveat: this advisory rests on a single source, CERT-FR advisory CERTFR-2026-AVI-1312\. The actively-exploited status of CVE-2026-96951 is attributed by CERT-FR to Microsoft; the underlying Microsoft bulletin was not retrieved for this note. Verify against the Microsoft October 2026 security update guide before acting on the exploitation claim in an incident context.

## 4\. Mitigation & containment

Priorities are set by the actively exploited CVE and by the breadth of the affected product set. CERT-FR directs readers to the Microsoft security bulletin for patches; it does not name a workaround for any CVE in this release.

P1, within 24 hours:

- Identify every endpoint and server in scope for the affected products: Microsoft 365 Apps for Enterprise (32 and 64 bit), Office 365 for Mac, Office LTSC 2021 and LTSC 2024 (32 and 64 bit), Office LTSC for Mac 2021 and 2024, Office for Android, Office Online Server, and Outlook.com tenant configuration. Use your software inventory or endpoint management console; do not rely on a manual sample.
- For CVE-2026-96951, the actively exploited CVE, apply the Microsoft fix from the 13 October 2026 update guide without waiting for the normal patch window. Confirm the applied build against the fixed versions listed in §3 for the relevant channel.
- Check whether CVE-2026-96951 exploitation has already occurred in your estate. CERT-FR gives no indicators, so scope this by Office process behaviour and outbound network activity from Office processes on the days before patching, and by any endpoint alerts already raised against Office binaries. Treat any positive as an incident under DORA Art. 17 and classify it under Art. 18.
- Confirm Outlook.com tenant settings and Office Online Server build. Office Online Server must be at 16.0.10417.20228 or later; Outlook.com must be at 20260925.100 or later.

P2, within 72 hours:

- Patch the remaining CVEs in the 13 October 2026 Microsoft Office release. Work from the Microsoft October 2026 security update guide rather than from the fourteen identifiers listed in §3, because that list is truncated. Prioritise any CVE in the release that Microsoft marks as exploited or as remote code execution in the absence of a resolved severity feed.
- For Microsoft 365 Apps for Enterprise, confirm the update channel (Current, Monthly Enterprise, Semi-Annual Enterprise) and force an update check on any device that has not moved to the fixed build. Devices pinned to a deferred channel may not have received the fix.
- For Office LTSC 2021 and LTSC 2024, verify the installed build number against the fixed versions in §3\. LTSC installs do not auto-update on the M365 cadence and are the most likely to be left behind.
- For Office for Android, push the update through your mobile device management enrolment; version 16.0.20430.20000 is the fixed floor.

P3, within 7 days:

- Add the fixed Office build numbers to your compliance baseline so that devices falling below them are reported automatically.
- Review whether Office macro execution, ActiveX, and OLE object activation policies are enforced on endpoints that open untrusted documents. CERT-FR does not name these as mitigations for this release; they are standing controls that reduce the impact of any Office code-execution CVE while a patch is pending.
- Confirm your Microsoft patch intake process covers Office Online Server and Outlook.com, which sit outside the standard endpoint patch path and are commonly missed.

## 5\. Indicators of compromise

No indicators of compromise available in the source material.

CERT-FR advisory CERTFR-2026-AVI-1312 publishes no hashes, domains, IP addresses, file paths, registry keys, or behavioural observables. The only machine-actionable facts it provides are the affected product versions and the CVE identifiers, both of which are in §3 and §4\. Do not treat the CVE identifiers as indicators; they are vulnerability references, not artefacts of an intrusion.

## 6\. Detection

Insufficient indicators to author detection rules.

The source provides no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text, or hard-coded values. The only strings available are CVE identifiers and product names, which are not artefacts of the threat and would produce rules that match reporting about the vulnerabilities rather than exploitation of them. Detection for this item must be built from the Microsoft bulletins once retrieved, or from your own endpoint telemetry on Office process behaviour.

## 7\. Sources

- ANSSI France CERT, "Multiples vulnérabilités dans Microsoft Office" (CERTFR-2026-AVI-1312), https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1312/, 14 October 2026.
- ANSSI France CERT, "Multiples vulnérabilités dans Microsoft Office" (CERTFR-2026-AVI-0727), https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0727/, 10 June 2026.
- ANSSI France CERT, "Multiples vulnérabilités dans Microsoft Office" (CERTFR-2026-AVI-0868), https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0868/, 15 July 2026.
- ANSSI France CERT, "Multiples vulnérabilités dans Microsoft Office" (CERTFR-2026-AVI-1000), https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1000/, 12 August 2026.
- ANSSI France CERT, "Vulnérabilité dans Microsoft Office" (CERTFR-2026-AVI-1072), https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1072/, 21 August 2026.
- ANSSI France CERT, "Multiples vulnérabilités dans Microsoft Office" (CERTFR-2026-AVI-1145), https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1145/, 9 September 2026.
- ANSSI France CERT, "Multiples vulnérabilités dans les produits Microsoft" (CERTFR-2026-AVI-1316), https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1316/, 14 October 2026.
- Microsoft Security Response Center, update guide entries for CVE-2026-100209, CVE-2026-100210, CVE-2026-100211, CVE-2026-100212, CVE-2026-102849, CVE-2026-102850, CVE-2026-102855, CVE-2026-102856, CVE-2026-102857, CVE-2026-102858, CVE-2026-102867, CVE-2026-105591, CVE-2026-105592, CVE-2026-105593, https://msrc.microsoft.com/update-guide/, 13 October 2026.

## 8\. Adverse Trace position

Adverse Trace assesses this as a priority patch cycle rather than a single-CVE emergency, with one exception: CVE-2026-96951 is stated by CERT-FR, on Microsoft's authority, to be actively exploited, and that claim is the reason this advisory is being issued at rather than held for the monthly roundup. We have not resolved CVSS scores, severities, or CISA KEV entries for any CVE in this release, so we are not asserting a severity rating; the exploitation status and the breadth of the affected product set are the basis for the P1 actions in §4\. The source is a single CERT-FR advisory and it does not publish mechanisms, vectors, or indicators, so clients should expect to work from the Microsoft October 2026 update guide for the technical detail and should not expect IOC-based hunting to be productive from this advisory alone. We will retrieve the Microsoft bulletins for CVE-2026-96951 and the full October 2026 Office release, publish the missing severity and exploitation data, and issue a follow-up if the exploitation picture widens beyond the single CVE. Clients running Office LTSC 2021 or LTSC 2024 should treat those builds as the highest-risk population, because they do not follow the Microsoft 365 update cadence and are the most likely to remain on a vulnerable version after the P1 window closes.

---

[Read the original source →](https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1312/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*