LibreOffice and Apache OpenOffice Flaws Enable Remote Code Execution via Malicious Spreadsheets Without Macro Warnings
Two vulnerabilities allow attackers to execute arbitrary code simply by opening manipulated office documents, bypassing the usual macro security warnings. The flaws affect LibreOffice Calc and Apache OpenOffice through their integration with Java and the way these applications resolve certain components when loading untrusted files.
CVE-2026-63277 impacts LibreOffice and permits a crafted spreadsheet to trigger loading of a Java database driver from a remote location. The root cause lies in class path handling: an attacker-controlled entry can point outside the local system, causing the application to fetch and execute classes from an external source. The fix enforces that every class path entry must be a file-type URL, effectively blocking remote class loading.
Users should update LibreOffice to version 26.2.5 or 26.8.0 or later. These releases also harden handling of external data links and JDBC connectors in Calc, reducing exposure in environments that regularly exchange spreadsheets containing database connections.
CVE-2026-59265 affects Apache OpenOffice 4.1.16 and earlier, enabling local or remote code execution when a malicious document abuses the Java integration. A stable patch is planned for 4.1.17, currently available only as a release candidate. Until then, administrators should disable Java support in OpenOffice wherever it is not strictly required.
Additional defensive steps include limiting Java usage across office suites on endpoints that frequently open attachments, enforcing strict policies against opening files from untrusted origins, and applying application isolation where feasible. Running office applications with the lowest possible privileges further contains any successful exploitation to the user’s permission boundary.
Related articles
Critical CVE-2026-111497 Out-of-Bounds Write Flaw in Google Brotli Decoder Impacts Broad Range of Environments
A severe vulnerability has been identified in the Google-developed Brotli decoder used for decompressing data in web communications and other applications. The flaw, tracked as CVE-2026-111497, allows out-of-bounds writes when processing specially crafted compressed data, potentially enabling arbitrary code execution, information disclosure, or denial of service. It carries a CVSS v4.0 base score of 9.2 and is rated Critical. Google has released patched versions 1.2.1, 1.1.1, and 1.0.10 of the library. Node.js incorporated the fix in its updates, while Microsoft issued an out-of-band patch for .NET on October 25, 2026, to address the issue. The vulnerability affects any environment relying on the Brotli C implementation for data decompression.
Critical Code Injection Flaw in Okta Access Gateway Allows Authenticated Command Execution
Okta disclosed CVE-2026-115547, a critical code injection vulnerability in the administrative console of Okta Access Gateway. An authenticated administrator can execute arbitrary commands on the underlying system using the privileges of the gateway service account. The flaw received a CVSS 3.1 score of 9.1 and stems from insufficient input validation when processing configuration values in a specific format. Affected appliances running versions prior to 2026.10.2 must be updated, as no workaround is provided. The same disclosure day also included CVE-2026-115546 for authentication source verification and two PHP execution issues (CVE-2026-109618, CVE-2026-109619) previously seen in Palo Alto PAN-OS. Exploitation requires administrative console access and no in-the-wild attacks have been reported.
GitLab Discloses 12-Year-Old CVSS 10.0 Vulnerability Enabling Unauthenticated Remote Code Execution
GitLab has published a critical security advisory for CVE-2026-110264, a CVSS 10.0 flaw that permits unauthenticated remote code execution on both Community and Enterprise self-hosted instances. The vulnerability has existed in the codebase since 2014 and affects every version up to the latest release prior to the October 2026 patch. Exploitation requires no credentials or special conditions, allowing attackers to run arbitrary commands, exfiltrate source code, deploy backdoors, or move laterally. The issue remained undetected through multiple code iterations, security audits, and version updates due to its hidden trigger conditions within the large, complex application. Organizations are urged to immediately verify their version, review access logs for anomalies, and apply the official fix, while temporary mitigations include network restrictions and enhanced monitoring.
Google Brotli Decoder Vulnerability CVE-2026-111497 Enables Remote Code Execution in Node.js, Python, Bun and Envoy
A critical out-of-bounds write flaw in Google's Brotli decoder (CVE-2026-111497) affects multiple widely used platforms including Node.js, Python, Bun and Envoy. Imperva researchers demonstrated reliable remote code execution on official Node.js 24.22.0 builds for Linux arm64, naming the exploit Node2Shell. The vulnerability allows crafted Brotli-compressed data to corrupt memory, leading to crashes, information leaks or arbitrary code execution. Affected versions include Node.js releases below 22.23.4, 24.22.1 and 26.12.1, plus all versions of the Python brotli and brotlicffi packages. Patches have been issued for Node.js, while other projects await updates; no in-the-wild exploitation has been observed yet. The incident highlights recurring supply-chain risks where a single foundational library impacts thousands of downstream applications.