Critical RCE Vulnerability in Microsoft 365 Apps Exploited via Malicious Excel Files

A newly disclosed remote code execution (RCE) vulnerability, tracked as CVE-2025-60727, affects Microsoft 365 Apps, allowing attackers to execute arbitrary code through malicious Excel documents. This vulnerability arises from an out-of-bounds read condition in Excel's file-parsing mechanism, leading to potential memory corruption. It impacts multiple versions of Microsoft Office and is particularly concerning in enterprise environments where document-based attacks are common. The vulnerability was publicly disclosed on June 29, 2026, and highlights the ongoing risks associated with phishing campaigns that utilize malicious documents. Organizations are urged to assess their defenses against this exploit vector.

Key Points: • CVE-2025-60727 allows RCE via malicious Excel files in Microsoft 365 Apps. • The vulnerability affects multiple versions of Microsoft Office, raising enterprise risks. • Attackers can exploit this flaw through common phishing techniques.