The Microsoft Office Online Server or Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over     a network. (CVE-2026-100210, CVE-2026-97003, CVE-2026-97004, CVE-2026-97007, CVE-2026-97748,     CVE-2026-97751, CVE-2026-97753, CVE-2026-97754, CVE-2026-97756, CVE-2026-97757, CVE-2026-97758,     CVE-2026-97763, CVE-2026-97765, CVE-2026-97766, CVE-2026-97768, CVE-2026-97769, CVE-2026-97773,     CVE-2026-97776, CVE-2026-97777, CVE-2026-97780)

  - Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
    (CVE-2026-100212, CVE-2026-97010, CVE-2026-97017, CVE-2026-97738, CVE-2026-97747, CVE-2026-97752,     CVE-2026-97771, CVE-2026-97775)

  - Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a     network. (CVE-2026-105718, CVE-2026-97755)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Security Updates for Microsoft Office Online Server (October 2026)

high Nessus Plugin ID 365474

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Oct 16, 2026, 7:34 PM Plugin metadata (Add IAVM Info) Plugin Feed: 202610161934
Version 1.3 Oct 15, 2026, 8:27 AM CVSSv3 score source (changed from "CVE-2026-97778" to none) Plugin Feed: 202610150827
Version 1.2 Oct 14, 2026, 9:52 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:O/RC:C") CVSSv2 score source (changed from "CVE-2026-100210" to "CVE-2026-97780") CVSSv3 score source (set to "CVE-2026-97778") Exploit attributes ("Exploit available" set to "False") Exploit attributes ("Exploitability ease" set to "No known exploits are available") Plugin Feed: 202610140952
Version 1.1 Oct 13, 2026, 11:46 PM New Plugin Feed: 202610132346