Unauthenticated RCE Threatens Office 365 and LTSC via High-Severity Access Heap Overflow CVE-2026-102850
A high-severity flaw in Microsoft Office Access allows network-based remote code execution, affecting Enterprise and LTSC builds until specific updates are applied.
Key points
- CVE-2026-102850 is a heap-based buffer overflow in Microsoft Office Access rated 8.8 HIGH by NVD.
- Unauthenticated attackers can exploit the flaw to execute arbitrary code over a network.
- Affected versions include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 prior to specified builds.
Microsoft has published an advisory for a remote code execution vulnerability in Microsoft Office Access. The flaw, tracked as CVE-2026-102850, stems from a heap-based buffer overflow that permits unauthorized network access.
What happened
The National Vulnerability Database assigns a CVSS score of 8.8 to CVE-2026-102850, classifying the severity as high. Microsoft’s Security Update Guide describes the issue as a heap-based buffer overflow within the Office Access application. According to the advisory, this defect allows an unauthorized attacker to execute code over a network. The weakness is categorized under CWE-122, which covers heap-based buffer overflow conditions.
Microsoft states that the vulnerability affects Microsoft 365 Apps for Enterprise versions preceding the latest security releases. It also impacts Microsoft Office LTSC 2021 versions before build 16.0.14334.20974. Additionally, Microsoft Office LTSC 2024 versions before build 16.0.17932.21056 are listed as affected in the NVD record. The official advisory directs users to Microsoft’s security release page for remediation details.
Why it matters
Remote code execution flaws in widely deployed office suites present significant risk to enterprise environments. The ability to execute arbitrary code remotely means that a successful compromise could lead to full system control. Organizations relying on older LTSC builds or delayed update cycles for Microsoft 365 Apps for Enterprise face exposure.
The high severity rating reflects the potential impact on confidentiality, integrity, and availability. Security teams must assess their inventory of Office Access installations to determine which versions fall within the affected range. This context aligns with broader trends in software component vulnerabilities, as seen in earlier reporting on critical risks in other enterprise applications.
Our take on the response
- Verify current builds of Microsoft Office Access against the affected version list.
- Prioritize deployment of security updates for Microsoft 365 Apps for Enterprise and LTSC 2021/2024.
- Monitor network traffic for unusual outbound connections from endpoints running Access.
- Review firewall rules to restrict unnecessary network access to Office applications.
What defenders should look for
Teams usually detect this type of activity through anomalous process creation or unexpected network connections from Office processes. Check whether Windows Event Logs show failed authentication attempts or unusual DLL
What to do and how to stay safe
- Inventory accuracy dictates the effectiveness of any vulnerability management program.
- Severity scores measure technical potential, not actual business risk.
- Patching speed matters less than reducing the window of exposure for critical assets.
Vulnerability management is a continuous process of identifying, prioritizing, and remedifying risks based on context, not just severity. Start by ensuring your asset inventory is complete and accurate before focusing on scan frequency.
Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget
General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.
