ZeroDay Findings
Sign inSign up

Findings

CVE-2016-7262

Microsoft Office Security Feature Bypass Vulnerability

Published Dec 19, 2016 · updated Jun 16, 2026 · microsoft excel

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted remote attackers to execute arbitrary commands via a crafted cell that is mishandled upon a click, aka "Microsoft Office Security Feature Bypass Vulnerability."

Timeline

Detection, updates, and resolution for this record.

  1. Dec 19, 2016 · Catalog

    Detected

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted remote attackers to execute arbitrary commands via a crafted cell that is mishandled upon a click, aka "Microsoft Office Security Feature Bypass Vulnerability."

  2. Mar 3, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Mar 24, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted remote attackers to execute arbitrary commands via a crafted cell that is mishandled upon a click, aka "Microsoft Office Security Feature Bypass Vulnerability."

Required action

Apply updates per vendor instructions.

CISA due date Mar 24, 2022

Affected

  • cpe microsoft/excel2007
  • cpe microsoft/excel2010
  • cpe microsoft/excel2013
  • cpe microsoft/excel2016
  • cpe microsoft/excel viewerversion unspecified
  • cpe microsoft/office compatibility packversion unspecified
  • vendor Microsoft Excelversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2016-7262

    A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2016-7262

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2016-7262

    30-day exploitation probability 57.7%

    first.org
  • NIST NVDVulnerability recordCVE-2016-7262

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted remote attackers to execute arbitrary commands via a crafted cell that is mishandled upon a click, aka "Microsoft Office Se

    nvd.nist.gov

References