Office Online Server vulnerabilities

3 known vulnerabilities in Office Online Server from Microsoft. 3 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Microsoft 365 Apps for Enterprise: Access of Resource Using Incompatible Type

  CVE-2026-65807Aug 11, 2026Microsoft

  Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

• 7.0 High severity

  Microsoft 365 Apps for Enterprise: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-44818Jun 9, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

• 7.8 High severity

  Microsoft Office Remote Code Execution Exploited

  CVE-2017-11826Oct 13, 2017MicrosoftEPSS 82.2%

  Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, and Office Online Server allow remote code executio