Microsoft patches CVE-2026-26144, a zero-click vulnerability in Excel
What CVE-2026-26144 Actually Is
CVE-2026-26144 is a cross-site scripting (XSS) flaw in the Copilot assistant embedded in Excel, and Microsoft has released a patch for it. The label "zero-click" is the part that matters most: the vulnerability triggers without the victim clicking a link, enabling a macro, or approving a prompt. Simply having the assistant process a crafted spreadsheet is enough to run attacker-controlled script in the context of the Copilot surface.
XSS is usually associated with web pages, but Copilot renders its responses inside a web-based view. When an AI assistant reads cell contents and reflects them back into that rendered panel, any markup or script smuggled into the data can be interpreted rather than displayed as plain text. That is the classic XSS pattern, moved into an AI feature that users tend to trust implicitly.
Why "Zero-Click" Raises the Stakes
Traditional document attacks depend on convincing someone to act — open a file, enable content, follow a warning past its guardrails. A zero-click chain removes that human step. The malicious payload lives in ordinary-looking spreadsheet data, and the assistant's own act of summarizing or answering questions about the sheet becomes the delivery mechanism.
This inverts a habit many users rely on. People have learned to be cautious about buttons and prompts, but asking Copilot to "summarize this sheet" feels harmless. Here, that harmless request is the trigger. Because the injected script executes with the privileges of the Copilot view, potential consequences include exfiltrating data the assistant can see or manipulating what the assistant reports back to the user.
The AI Assistant as a New Attack Surface
The deeper lesson is that AI features change where untrusted input flows. An assistant that ingests a document and renders generated output has effectively created a new sink for whatever the document contains. If that output is not strictly separated from executable markup, attacker text can cross from "data being analyzed" into "code being run."
Concretely, this class of bug tends to come from a few recurring gaps:
- Assistant responses that echo cell values without encoding them for the rendering context.
- Insufficient separation between the model's generated text and the HTML that displays it.
- Trust placed in spreadsheet content simply because it arrived as structured data rather than as a web request.
What To Do About It
The primary action is straightforward: apply Microsoft's patch. Since this fix targets a cloud-connected Copilot experience, much of the remediation may be delivered server-side, but organizations should still confirm that their Office and Copilot clients are current and that automatic updates are not being blocked by policy. Verify coverage across managed devices rather than assuming a single update reached everyone.
Beyond patching, treat this as a prompt to review how AI assistants handle untrusted content in your environment. Consider limiting which documents Copilot processes from external or unvetted sources, and check whether logging would let you detect anomalous assistant behavior after the fact. For teams building their own AI features, the takeaway is to encode and sandbox model output the same way you would any user-supplied string reflected into a page — the assistant does not sanitize the data for you.