- CISA adds 18-year-old Excel bug (CVE-2009-0238) to KEV catalog
- Vulnerability enables RCE via malicious Excel files, patched long ago
- Outdated systems remain at risk; agencies ordered to patch before April 28
Incredibly, there are still systems vulnerable to 18-year-old Microsoft Excel vulnerabilities, and, unsurprisingly, cybercriminals are taking advantage of that fact.
The US Cybersecurity and Infrastructure Security Agency (CISA) recently updated its catalog of known exploited vulnerabilities (KEVs), a list of flaws that have been confirmed to have been exploited in the wild, to add CVE-2009-0238, a bug in Microsoft Excel first discovered in 2009.
According to the National Vulnerability Database (NVD), the bug allows threat actors to execute arbitrary code (RCE) via a crafted Excel document “that triggers an attempt to access an invalid object.”
Article continues below.
One week to patch
This vulnerability, with a severity score of 8.8/10 (high), was first observed in the distribution of the Trojan.Mdropper.AC malware.
Affects Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Support package for Word, Excel, and PowerPoint 2007 SP1 file formats; and Excel in Microsoft Office 2004 and 2008 for Mac. It was patched literally years ago.
Even so, it seems that there are systems that still use this very obsolete and, therefore, vulnerable software. CISA added the bug to KEV on April 14, 2026 and gave FCEB agencies one week to fix it (April 28).
Other than that, we don’t know much about who is exploiting the bug and for what purpose. CISA could not say whether the flaw was being used in ransomware infections or not. We can assume that the attacks include a phishing email with a weaponized Excel document.
Also, if we assume that the versions not on the list are safe, that would mean that anyone running them is not at risk:
Excel 2007 (SP2 and later)
excel 2010
excel 2013
excel 2016
excel 2019
excel 2021
Excel for Microsoft 365 (all versions)
Excel for Mac (versions after 2008).
Through The Registry
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds. Be sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp also.
