Microsoft 365 threat report

CVE-2026-70242, a critical heap-based buffer overflow in Microsoft Office Outlook, allows remote code execution without user interaction or authentication (CVSS 9.8). The vulnerability affects Microsoft 365 Apps, Office 2024, and Office 2021. Microsoft published the CVE on October 13, 2026, and reference guidance is available on MSRC. No active exploitation has been confirmed at the time of disclosure.

• CVE-2026-70242 - Microsoft Office Outlook Remote Code Execution (opens in a new tab)