An ancient Microsoft Excel security flaw could let hackers hijack your entire system, so patch now
CISA is warning about ongoing exploitation of a 2008 bug
by https://www.techradar.com/uk/author/sead-fadilpai · TechRadarNews By Sead Fadilpašić published 16 April 2026
Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Become a Member in Seconds
Unlock instant access to exclusive member features.
Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors
By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.
You are now subscribed
Your newsletter sign-up was successful
Join the club
Get full access to premium articles, exclusive features and a growing list of member rewards.
An account already exists for this email address, please log in. Subscribe to our newsletter
- CISA adds 18‑year‑old Excel flaw (CVE‑2009‑0238) to KEV catalog
- Vulnerability enables RCE via malicious Excel files, patched long ago
- Outdated systems still at risk; agencies ordered to patch by April 28
Incredible as it may sound, there are still systems out there vulnerable to 18-year-old Microsoft Excel vulnerabilities, and unsurprisingly, cybercriminals are taking advantage of that fact.
The US Cybersecurity and Infrastructure Security Agency (CISA) recently updated its Known Exploited Vulnerabilities (KEV) catalog - a list of flaws confirmed to be exploited in the wild, to add CVE-2009-0238, a bug in Microsoft Excel first discovered in 2009.
According to the National Vulnerability Database (NVD), the bug allows threat actors to execute arbitrary code (RCE) via a crafted Excel document “that triggers an access attempt on an invalid object”.
Article continues below
A week to patch
This vulnerability, given a severity score of 8.8/10 (high), was first observed delivering the Trojan.Mdropper.AC malware.
It affects Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac. It was patched literally ages ago.
Still, it seems that there are systems out there still using this severely outdated, and thus vulnerable, software. CISA added the bug to KEV on April 14 2026, and gave FCEB agencies a week’s time to patch up (April 28).
Other than that, we don’t know much about who is exploiting the bug and to what end. CISA could not say if the flaw was being used in ransomware infections, or not. We can assume that the attacks include a phishing email with a weaponized Excel document.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors