Microsoft week 39 2026: two high-severity Outlook remote code execution flaws in two-CVE release

The release at a glance

Microsoft's vulnerability release for week 39 of 2026, covering 21–27 September 2026, contains two CVEs, both rated high severity. The affected software is Microsoft Outlook across three Office servicing channels: Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Neither CVE appears in CISA's Known Exploited Vulnerabilities catalogue, and the records state no exploitation or public disclosure has occurred. Microsoft has made fixes available for both issues through its Office Security Releases page. Because the release is small, the main decision is straightforward: apply the latest Office security update to the affected channels. No lower-severity CVEs are present in this week's release.

What matters most

Both vulnerabilities affect the same Outlook estate, so the affected-product list is identical across the three servicing channels: Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. CVE-2026-70125 was published on 23 September 2026, and CVE-2026-100208 on 25 September 2026.

CVE-2026-70125 is the first-priority item. Microsoft describes it as a remote code execution vulnerability in Outlook and rates it Important. The CVSS 3.1 vector sets a base score of 8.8: network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality, integrity and availability impact. Exploit code maturity is recorded as unproven, the remediation level is official fix, and report confidence is confirmed. The EPSS score is 0.4 percent, with percentile 36. SSVC marks exploitation as none, automatable as no, and technical impact as total. The CVE record does not list a CISA KEV entry.

CVE-2026-100208 is also a remote code execution vulnerability in Outlook, but the CVE record attributes it to an integer overflow or wraparound, CWE-190. The CVSS 3.1 score is 7.5 with high attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality, integrity and availability impact. The remaining vector components match the first: unproven exploit maturity, official fix, confirmed report confidence. EPSS is 0.3 percent, percentile 26, and SSVC records exploitation as none, automatable as no, and technical impact as total. Microsoft's advisory lists the same affected products and available Office security fixes for both CVEs.

Patch in this order

1. Start with CVE-2026-70125. Its 8.8 CVSS base score, low attack complexity and network attack vector make it the most important item in a two-CVE week. Apply the Office security update available through Microsoft's Security Update Guide to Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024.

1. Verify the same update covers CVE-2026-100208. The affected product list is identical, so a single deployment wave should close both Outlook vulnerabilities. If separate validation is required, treat CVE-2026-100208 as the second priority: it has a 7.5 base score and high attack complexity, but still permits code execution over the network.

1. Document that no CISA KEV due date applies to this release. Neither CVE is currently in the Known Exploited Vulnerabilities catalogue, so there is no CISA remediation deadline to track.

1. Continue the regular Office update cadence after this release. There are no lower-severity CVEs in scope this week, so the patch cycle is complete once both Outlook fixes are verified.

Beyond the patch

Two-CVE weeks turn release response into a short, measurable workflow, but the preconditions are endpoint visibility and patch-cycle discipline. Both Outlook flaws are network-vector, unauthenticated remote code execution issues, so any successful attempt would leave evidence in endpoint detection and SIEM telemetry. Our Managed Detection & Response (MDR) service covers that use case directly. For teams that want tighter control over supplier patch cadence and exposure windows, Supply Chain Defense & Third-Party Risk helps track how quickly deployed software is fixed.