Which products and versions are affected by CVE-2021-34501?

Affected: 365 Apps (Microsoft); Excel (Microsoft) versions 2013-sp1, 2016; Office (Microsoft) versions 2019, among others. The full list is in the CVE brief.

Is CVE-2021-34501 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2021-34501 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2021-34501?

No public exploit code is known.

Is there a fix for CVE-2021-34501?

Fixed versions are available, including 365 Apps https://aka.ms/OfficeSecurityReleases, Excel 15.0.5363.1000, Excel 16.0.5188.100.

How urgently should CVE-2021-34501 be patched?

Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Request A Demo

Vulnerability Intelligence

CVE-2021-34501

High

Microsoft Excel Remote Code Execution Vulnerability

Published Jul 14, 2021 · Updated Aug 10, 2026

Key Facts

Patch immediately

CVE-2021-34501 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting 365 Apps (Microsoft), Excel (Microsoft), Office (Microsoft) and 1 more product.
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 52% probability of exploitation in the next 30 days.
Fixed versions are available, including 365 Apps https://aka.ms/OfficeSecurityReleases, Excel 15.0.5363.1000, Excel 16.0.5188.100.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

8.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

52%

Higher than 98.9% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2021-34501 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Microsoft Excel Remote Code Execution Vulnerability

Affected Products

12 affected entries in total

Product	Affected versions	Fixed in
365 AppsMicrosoft	See advisory	https://aka.ms/OfficeSecurityReleases
ExcelMicrosoft	2013-sp1, 2016	15.0.5363.1000
OfficeMicrosoft	2019	https://aka.ms/OfficeSecurityReleases
Office Online ServerMicrosoft	See advisory	16.0.10376.20001

Patched Releases

365 Apps

https://aka.ms/OfficeSecurityReleases

Excel

15.0.5363.1000, 16.0.5188.100, 16.0.5188.1000

Office

16.51.210711.01, https://aka.ms/OfficeSecurityReleases

Office Online Server

16.0.10376.20001

Timeline

Publicly disclosed
Jul 14, 2021
Last updated
Aug 10, 2026

References

FAQ

Common Questions.

Microsoft Excel Remote Code Execution Vulnerability
Affected: 365 Apps (Microsoft); Excel (Microsoft) versions 2013-sp1, 2016; Office (Microsoft) versions 2019, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including 365 Apps https://aka.ms/OfficeSecurityReleases, Excel 15.0.5363.1000, Excel 16.0.5188.100.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Is CVE-2021-34501 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.