Microsoft Office

CVE-2012-1856 and 10 related

HIGHActively exploited by attackers

Why this is on the list

Published on CISA Known Exploited Vulnerabilities evidence. Exploitation is confirmed by CISA; the exact affected version range and vendor fixed build are not yet vendor-confirmed. Remediation follows CISA's required action. This entry upgrades automatically when the vendor advisory is ingested.

CISA added this to its Known Exploited Vulnerabilities Catalog on 2022-03-03.
CISA records it as having been used in ransomware campaigns.

Does this apply to your version?

An affected range is on record, published through the CVE Program by the authority responsible for this product. Check your own release against it, or enter it in the lookup and Patient Protect will evaluate it for you.

Affected: =365 ProPlus for 32-bit Systems OR =365 ProPlus for 64-bit Systems

Check your version

What to do

Apply the vendor-fixed release or documented mitigation as a priority; this vulnerability is known to be exploited.

Vendor: Microsoft
Product: Microsoft Office
Affected versions: =365 ProPlus for 32-bit Systems OR =365 ProPlus for 64-bit Systems
First published: 2026-09-05

Where this comes from

3 sources

CISAPrimary government source
Confirms active exploitation · Informs severity
Vulnerability is exploited in the wild (CISA KEV listing)
Read the CISA record
CVE RecordCNA-supplied evidence
Defines affected versions · Defines the fixed release · Determines whether a version is affected
CNA-published affected versions and remediation
Read the CVE record
FIRSTSupporting intelligence
Informs severity
EPSS estimates a 72% probability that this vulnerability will be exploited in the next 30 days. It is a forecast about the vulnerability, not a statement about whether your installation is affected.
About EPSS

How this was assessed

CVE-2012-1856 triggered rule KEV_KNOWN_EXPLOITED
CISA KEV lists it as known-exploited
EPSS 0.72225
no affected version range is available for the mapped product
Patient Protect score 70.44 (HIGH) under pp-risk-1.0
remediation provenance: PP_TEMPLATE
evidence incomplete

Information provided by Patient Protect's Technology Risk Ledger (“The Naughty List”) is sourced from official vendor and government advisories and is provided “as is” for informational purposes only. Inclusion on The Naughty List identifies a documented technology-security risk based on available evidence at the time of publication; it is not a finding of wrongdoing, negligence, or fault by any vendor. Patient Protect does not warrant the completeness, accuracy, or timeliness of the information. Users are solely responsible for verifying applicability to their specific environment and for their own remediation decisions. Patient Protect disclaims all liability for damages arising from the use of this information.

Do you run this?

Check your own version against the ledger — it may or may not fall inside the affected range.

Check your technology