CVE-2016-7262Microsoft Office Security Feature Bypass Vulnerability

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted remote attackers to execute arbitrary commands via a crafted cell that is mishandled upon a click, aka "Microsoft Office Security Feature Bypass Vulnerability."

7.8 HIGHEPSS 58.84%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 00:52 UTC

OverviewCVSS details

7.8HIGHCVSS 3.1

Score source: NVD
NVD status: Analyzed
Published: Dec 20, 2016
Assigner: microsoft

Affected

excel (microsoft)

Versions: 2007 sp3 · 2010 sp2

+2 more products →

Exploitation

Public exploit: None listed
CISA KEV: Listed · Mar 3, 2022
KEV due date: Mar 24, 2022
Ransomware use: Unknown
SSVC: Exploitation active · Automatable no · Impact total

EPSS · FIRST, scored Nov 7

58.84%chance of exploitation in 30 days

Higher than 99.11% of CVEs

CVSS 3.1 · NVD

7.8High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector: Local
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

CVSS 2.0 · NVD

6.8Medium

AV:N/AC:M/Au:N/C:P/I:P/A:P

Attack vector: Network
Attack complexity: Medium
Authentication: None
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
7.8	HIGH	3.1NVD	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8	MEDIUM	2.0NVD	AV:N/AC:M/Au:N/C:P/I:P/A:P

CISA required action

⚡ Known exploited · remediation due Mar 24, 2022

Apply updates per vendor instructions.

Details

CVE ID: CVE-2016-7262
Status: Analyzed
Assigner (CNA): microsoft
Published: Dec 20, 2016
Last modified: 2026-06-17 00:52 UTC
Weaknesses: CWE-20

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 12:07 UTC.