CVE-2016-7262
High 7.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Microsoft Office Security Feature Bypass Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted remote attackers to execute arbitrary commands via a crafted cell that is mishandled upon a click, aka "Microsoft Office Security Feature Bypass Vulnerability."
Metrics
- CVSS 3.1
-
7.8 (HIGH)
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 58% (percentile: 99) as of 1 November 2026
Affected products
microsoft: excel; microsoft: excel viewer; microsoft: office compatibility pack
References
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-1… PatchVendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-1… PatchVendor Advisory
- http://www.securityfocus.com/bid/94660 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037441 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/94660 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037441 Broken LinkThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016… US Government Resource