Is CVE-2009-0238 (Microsoft Office Remote Code Execution) being exploited in the wild?

Yes. CISA added CVE-2009-0238 to its Known Exploited Vulnerabilities catalogue on 14 April 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.

How CISA KEV status changes the answer

CISA KEV inclusion is the practical signal that matters most for this question. It means the vulnerability is being treated as actively exploited, so the issue is no longer theoretical. For defenders, the question shifts from “is this worth tracking?” to “where is it exposed, and how quickly can we remove the attack path?”

That is why CISA Known Exploited Vulnerabilities Catalog should be checked alongside the vendor advisory, while NIST National Vulnerability Database remains the best place to cross-reference the record, affected product context, and general vulnerability metadata.

In Microsoft Office cases, the real operational question is often exposure through document handling rather than server reachability. If users can open hostile Excel content, the exploitation path may exist even in otherwise well-managed environments, especially where email filtering, macro controls, or attachment handling are inconsistent across user groups.

What exploitation typically looks like in practice

This type of Microsoft office remote code execution flaw is usually triggered through user interaction with a specially crafted file. The attacker does not need direct infrastructure access first, only a delivery path that gets the malicious spreadsheet in front of a target and a way to persuade the target to open it.

That delivery pattern makes it a classic blend of application abuse and user-triggered execution. The payload may be embedded in the file structure, hidden in a malformed object, or wrapped in a broader lure that looks legitimate enough to bypass casual review. The underlying risk is not just code execution, but the initial foothold it creates for further compromise.

For version and record details, use the CVE Program entry as the canonical identifier source, then validate exploitation status and operational priority with CISA and the vendor’s own guidance.

What to check before you assume you are safe

Do not stop at patch availability. First confirm whether Microsoft Office Excel is present on endpoints that can receive external files, whether document protection features are enforced, and whether any business process routinely opens spreadsheets from email, downloads, shared drives, or external partners. If the vulnerable application is deployed but rarely used, exposure may still exist through legacy workflows and service desks.

Then verify whether controls around document provenance, attachment handling, and endpoint isolation are actually effective in day-to-day use. In many environments, the control failure is not a missing policy, but a path where a user with normal privileges can still open untrusted content on a machine that has access to sensitive data or trusted internal resources.

When patching must wait, reduce the attack surface immediately by tightening file intake, blocking unnecessary spreadsheet sources, and isolating higher-risk user populations. If you cannot remove the vulnerable version quickly, treat the delay as a temporary exposure window and look for compensating controls that reduce the chance of malicious file execution.

Risk and Threat Considerations

The main risk is that a single malicious Excel file can become an initial access vector with full system impact. Once exploited, the attacker may be able to run code in the context of the user who opened the file, which can lead to credential theft, internal pivoting, or deployment of additional malware.

Failure mechanism: A malformed object in a crafted spreadsheet is processed by Office during file open, allowing arbitrary code execution before the user realises the file is hostile.

Impact: Successful exploitation can give the attacker control of the affected endpoint, create a foothold for broader compromise, and expose any data or sessions reachable from that system.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5, OWASP ASVS and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited software flaws require rapid identification and remediation prioritization.
Recommendation — Prioritize and remediate KEV-listed Office exposure as an urgent vulnerability-management item.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	A known exploited Office flaw requires controlled remediation and verification of fix deployment.
Recommendation — Apply SI-2 to accelerate patching and verify affected endpoints are remediated.
OWASP ASVS	V15 — Secure Coding and Architecture	File parsing and object handling weaknesses can lead to remote code execution in applications.
	V16 — Security Logging and Error Handling	Exploitation of crafted files benefits from detection through logs and error telemetry.
Recommendation — Review document-handling paths for unsafe parsing and malformed-object execution risk. Correlate Office and endpoint telemetry to detect suspicious document-triggered execution.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerability Identification	Exposure decisions depend on knowing where the vulnerable Office version is deployed.
Recommendation — Inventory affected Office deployments and map them to exposure and remediation priority.

Practitioner Guidance

What to verify: Confirm whether any business unit still accepts spreadsheets from external email, file shares, or partner portals without strong filtering or sandboxing. That workflow is often the real exposure point, not the Office installation itself.

Decision rule: If the vulnerable software is present on internet-reachable or high-trust user endpoints, treat remediation as urgent and pair it with temporary exposure reduction rather than waiting for “normal” maintenance windows.

What good looks like: You should be able to identify where the product exists, who can open untrusted files with it, and what compensating controls apply while the fix is being rolled out.

Practitioner takeaway: For KEV-listed Office flaws, the priority is to remove exploitable file-open paths fast, then validate whether any endpoint already showed signs of malicious document handling before the fix landed.