Critical Microsoft Vulnerability CVE-2026-3061 Allows Remote Code Execution

Microsoft has released security guidance for a critical vulnerability affecting multiple products. CVE-2026-3061 carries a CVSS score of 9.8 and allows remote code execution without authentication.

Impact Assessment

Attackers can exploit this vulnerability to take complete control of affected systems. No user interaction is required. The vulnerability exists in how Microsoft products handle specially crafted files.

Affected Products

The following Microsoft products are affected:

• Windows 10 (version 1803 and later)
• Windows 11 (all versions)
• Microsoft Office 2019 and 2021
• Microsoft 365 Apps
• Microsoft Office for Mac
• Microsoft SharePoint Server

Technical Details

The vulnerability is a memory corruption flaw in the way Microsoft Office processes RTF files. When a user opens a maliciously crafted RTF document, the vulnerability could allow remote code execution in the security context of the current user.

Mitigation

Microsoft has released security updates to address this vulnerability. Organizations should apply the following patches immediately:

• For Windows systems: Install the latest security updates released on June 11, 2026
• For Microsoft Office: Update to version 2106 or later
• For SharePoint Server: Apply the June 2026 security update

Workarounds

If immediate patching is not possible, Microsoft recommends the following mitigations:

1. Block RTF file extensions in email gateways
2. Configure Microsoft Office to open files in Protected View
3. Implement application control policies to prevent execution from untrusted locations

Timeline

• June 1, 2026: Vulnerability discovered
• June 8, 2026: Microsoft notified
• June 11, 2026: Security updates released
• June 25, 2026: Public disclosure

Microsoft has stated that they are not aware of any attacks exploiting this vulnerability in the wild. However, the critical CVSS score and ease of exploitation make this a high-priority security concern.

For complete technical details, refer to the official Microsoft Security Advisory. Additional information is available in the Microsoft Security Response Center blog.

Organizations experiencing issues with the updates should contact Microsoft Support through their official support portal.