🔥 This vulnerability is being actively exploited in the wild (CISA Known Exploited Vulnerabilities catalog)
CVE-2009-0238: Microsoft Office Remote Code Execution
Summary
Microsoft Office Excel has a remote code execution vulnerability (RCE, where an attacker can run commands on a system they don't own) that could give an attacker complete control of a computer if someone opens a specially crafted Excel file containing a malformed object (a corrupted piece of data). This vulnerability is actively being exploited by attackers in the real world.
Solution / Mitigation
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. See Microsoft's security bulletin at https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 for specific guidance.
Vulnerability Details
EPSS: 57.2%
Yes
🔥 Actively Exploited
April 13, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2009-0238
First tracked: April 14, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 95%