Security Update 16.115 for Office for Mac--Build 26110837 Closes 140 CVEs in Word, Excel, PowerPoint and the Office Suite, 18 of Them Rated Critical Including Two That Open From the Preview Pane, Still Lists Office 2021 for Mac as Fixed a Month After Its Support Ended, and the Month's One Exploited Outlook Bug Is Listed for Windows Only

Sources

1. Microsoft, “Release notes for Office for Mac - Office release notes | Microsoft Learn” accessed Nov 13, 2026The November 10, 2026 entry: "Version 16.115 (Build 26110837)"; Feature updates, Outlook only: "OLM Import is now supported for Mail and Contacts", "Filter your message list by event related messages", "OFT templates for draft creation are now supported", "See and update your work location and working hours from list view and agenda view", "Print event descriptions in plain text when printing in list view"; Resolved issues: Excel, OneNote, Outlook, PowerPoint and Word each "Quality and performance improvements."; Security updates under four headings, Excel, Office Suite, PowerPoint and Word, with 140 distinct CVE ids by our count (57, 20, 6 and 57), including CVE-2026-120003 and CVE-2026-111289 under Office Suite; no Outlook security heading and no CVE-2026-124194. The October 27, 2026 entry, "Version 16.114.3 (Build 26102720)", and the November 4, 2026 entry, "Version 16.114.4 (26110224)", each carry under Office Suite: "A previous update inadvertently disabled Office 2021 for existing users. This update resolves the issue and fully restores functionality for affected customers." The page's notes: "These release notes also apply to Office LTSC 2021 and 2024 and Office 2021 and 2024, which are available as a one-time purchase from a retail store or through a volume licensing agreement." and "A minimum of macOS 14 (Sonoma) is required to receive updates to Microsoft 365 and Office apps." Accessed November 13, 2026.
2. Microsoft, “November 2026 Security Updates - Security Update Guide - Microsoft Security Response Center” accessed Nov 13, 2026The Security Update Guide's November 2026 release, filtered by product: for each of "Microsoft Office LTSC for Mac 2024", "Microsoft Office 365 for Mac" and "Microsoft Office LTSC for Mac 2021" it lists 141 CVEs, 18 with severity Critical and 123 Important, every row with fixed build 16.115.26110837 and the release notes page as the download; 140 rows dated November 10, 2026 and one, CVE-2026-126526 (Important, Remote Code Execution), dated November 11, 2026. Against the release notes' 140 ids the guide's list has three the notes lack (CVE-2026-126526, CVE-2026-88217, CVE-2026-95953) and lacks two the notes carry (CVE-2026-108450, CVE-2026-81400), by our comparison; all 18 Critical ids are in both lists. The page is rendered in the browser from the guide's data service; the counts were read through that service (api.msrc.microsoft.com/sug/v2.0/en-US/affectedProduct) on November 13, 2026, and its title tag is the generic "Security Update Guide - Microsoft Security Response Center".
3. Microsoft, “CVE-2026-120003 Microsoft Office Remote Code Execution Vulnerability - Security Update Guide - Microsoft Security Response Center” accessed Nov 13, 2026Released November 10, 2026: "Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network."; CWE-122; severity Critical; impact Remote Code Execution; base score 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); Publicly disclosed: No; Exploited: No; "Exploitation Less Likely"; the one FAQ: "Is the Preview Pane an attack vector for this vulnerability? Yes, the Preview Pane is an attack vector."; affected products include Microsoft Office LTSC for Mac 2024, Microsoft Office 365 for Mac and Microsoft Office LTSC for Mac 2021, each with status fixed and fixed build 16.115.26110837. The page is rendered in the browser from the guide's data service, which is where the values were read on November 13, 2026.
4. Microsoft, “CVE-2026-111289 Microsoft Office Remote Code Execution Vulnerability - Security Update Guide - Microsoft Security Response Center” accessed Nov 13, 2026Released November 10, 2026: "Use after free in Microsoft Office allows an unauthorized attacker to execute code over a network."; CWE-416; severity Critical; impact Remote Code Execution; base score 8.8; Publicly disclosed: No; Exploited: No; "Exploitation Less Likely"; FAQ: "Yes, the Preview Pane is an attack vector." and "An attacker could convince a user to open or preview a specially crafted Office file. Successful exploitation could allow code to run with the user's privileges."; affected products include Microsoft Office LTSC for Mac 2024, Microsoft Office 365 for Mac and Microsoft Office LTSC for Mac 2021, each fixed in 16.115.26110837. Read through the guide's data service on November 13, 2026.
5. Microsoft, “CVE-2026-124194 Microsoft Outlook Spoofing Vulnerability - Security Update Guide - Microsoft Security Response Center” accessed Nov 13, 2026Released November 10, 2026; severity Moderate; impact Spoofing; base score 6.5; Exploited: Yes, "Exploitation Detected"; Publicly disclosed: No; FAQ: "An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user."; six affected products: Microsoft 365 Apps for Enterprise for 32-bit Systems and for 64-bit Systems, Microsoft Office LTSC 2021 for 32-bit editions and for 64-bit editions, Microsoft Office LTSC 2024 for 32-bit editions and for 64-bit editions; no Mac product. Read through the guide's data service on November 13, 2026.
6. BleepingComputer, “Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day” accessed Nov 13, 2026Lawrence Abrams, November 10, 2026, 02:07 PM: "Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability."; "This Patch Tuesday addresses 66 \"Critical\" vulnerabilities, 48 of which are Remote Code Execution (RCE)"; the zero-day is "CVE-2026-124194 - Microsoft Outlook Spoofing Vulnerability", "actively exploited in attacks to steal NTLM account hashes." Accessed November 13, 2026.
7. CISA, “Known Exploited Vulnerabilities Catalog | CISA” accessed Nov 13, 2026The catalog's entry for CVE-2026-124194 (catalog version 2026.11.10, read from the catalog's JSON feed on November 13, 2026): vendor Microsoft, product Office, "Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability", date added 2026-11-10, due date 2026-11-24.
8. Microsoft, “Deployment guide for Office for Mac - Microsoft 365 Apps | Microsoft Learn” accessed Nov 13, 2026"Support for Office LTSC for Mac 2021 ends on October 13, 2026. Organizations should plan to upgrade to Microsoft 365 Apps."; Office LTSC for Mac 2024 "receives security and quality updates, as needed." Accessed November 13, 2026.
9. Microsoft Support, “Update Office for Mac automatically | Microsoft Support” accessed Nov 13, 2026"Open a Microsoft 365 app such as Word, then on the top menu, select Help > Check for Updates."; "Select Automatically keep Microsoft apps up to date". Accessed November 13, 2026.
10. Microsoft, “Update history for Office for Mac - Office release notes | Microsoft Learn” accessed Nov 13, 2026The newest row, "November 10, 2026 | 16.115 (26110837)": the install package Microsoft_365_and_Office_16.115.26110837_Installer.pkg (without Teams; a BusinessPro installer carries Teams) and update packages Microsoft_Word_16.115.26110837_Updater.pkg, Microsoft_Excel_16.115.26110837_Updater.pkg, Microsoft_PowerPoint_16.115.26110837_Updater.pkg, Microsoft_Outlook_16.115.26110837_Updater.pkg and Microsoft_OneNote_16.115.26110837_Updater.pkg. Accessed November 13, 2026.