As a part of it’s monthly “Patch Tuesday”, Microsoft has released an update for two (2) Excel zero-day vulnerabilities, impacting Microsoft Excel versions 2013-2021, that have been actively exploited in-the-wild by unauthorized threat actors. The vulnerabilities, tracked as CVE-2021-42292 and CVE-2021-42321, are critical security bypasses that if exploited would allow an attacker to perform remote code execution (RCE). Despite the CVSS scores, these specific vulnerabilities do require an attacker to be authenticated in the target system, meaning they would need to get access before attempting to exploit these flaws. At this time, Microsoft urges all Windows users to update to the latest patch. As of this time, Microsoft has stated the patch for MacOS is not ready, “The security update for Microsoft Office 2019 for Mac and Microsoft Office LTSC for Mac 2021 are not immediately available…The updates will be released as soon as possible, and when they are available, customers will be notified via a revision to this CVE information.” There were many more patched vulnerabilities, and readers can look at the specifics in the below articles. The Ankura CTAPT will provide an update on this matter to our readers when the MacOS patch is published.