A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in Protected View, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Excel.

The Microsoft Excel Products are missing a security update.
It is, therefore, affected by the following vulnerability :

  - A remote code execution vulnerability exists in     Microsoft Excel software when the software fails to     properly handle objects in Protected View. An attacker     who successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2018-8502)

The Microsoft Office Products are missing security updates.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in     Microsoft Word software when the software fails to     properly handle objects in Protected View. An attacker     who successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2018-8504)

  - A remote code execution vulnerability exists in     Microsoft PowerPoint software when the software fails to     properly handle objects in Protected View. An attacker     who successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2018-8501)

  - A remote code execution vulnerability exists in     Microsoft Excel software when the software fails to     properly handle objects in Protected View. An attacker     who successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2018-8502)

ID	Name	Product	Family	Severity
162084	Security Updates for Microsoft Excel Products C2R (October 2018)	Nessus	Windows	high
162056	Security Updates for Microsoft Office Products C2R (October 2018)	Nessus	Windows	high
118010	Security Updates for Microsoft Office Products (October 2018)	Nessus	Windows : Microsoft Bulletins	high
118007	Security Updates for Microsoft Excel Products (October 2018)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2018-8502

high

Tenable Plugins

high

high

high

high