Snapshot of public data from 31 Oct 2026, 12:50:06. This data is not updated until the API is deployed.

CVE-2026-54131

Microsoft 365 Apps for Enterprise

NormalCVSS 7.8 v3.1

Why this priority

Generic watch priority computed by public, versioned rules. It does not know your assets. See the glossary

This source does not allow its text to be republished here. Read the record at the source.

Vendor	Product	Versions
Microsoft	Microsoft 365 Apps for Enterprise	from 16.0.1 to https://aka.ms/OfficeSecurityReleases excluded
Microsoft	Microsoft Office 2019	from 19.0.0 to https://aka.ms/OfficeSecurityReleases excluded
Microsoft	Microsoft Office 365 for Mac	from 1.0.0 to 16.111.26071215 excluded
Microsoft	Microsoft Office LTSC 2021	from 16.0.1 to https://aka.ms/OfficeSecurityReleases excluded
Microsoft	Microsoft Office LTSC 2024	from 16.0.0 to https://aka.ms/OfficeSecurityReleases excluded
Microsoft	Microsoft Office LTSC for Mac 2021	from 16.0.1 to 16.111.26071215 excluded
Microsoft	Microsoft Office LTSC for Mac 2024	from 16.0.0 to 16.111.26071215 excluded
Microsoft	Office Online Server	from 16.0.0.0 to 16.0.10417.20175 excluded

CVSS severity ? Technical severity score between 0 and 10, with its version (3.1, 4.0). See the glossary: 7.8 HIGH CVSS v3.1CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
KEV catalog ? CISA catalog of vulnerabilities with confirmed exploitation. Absence from the catalog does not prove absence of exploitation. See the glossary: Unknown
Exploitation: Not reported
EPSS probability ? Probability, between 0 and 1, that a vulnerability is exploited in the next 30 days, published daily by FIRST. Always dated. See the glossary: Unknown
Confidence ? Quality of the sources behind the record. It is not a risk score. See the glossary: High

Priority rules, version 1