An elevation of privilege vulnerability exists when Office Web Apps Server 2013 and Office Online Server fail to properly handle web requests. An attacker who successfully exploited this vulnerability could perform script/content injection attacks and attempt to trick the user into disclosing sensitive information.
To exploit the vulnerability, an attacker could send an email message containing a malicious link to a user. Alternatively, an attacker could use a chat client to social engineer a user into clicking the malicious link. The user must click the malicious link for the vulnerability to be exploited.
The security update addresses the vulnerability by correcting how Office Web Apps Server 2013 and Office Online Server validate web requests.
## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Microsoft | Microsoft Office Online Server 2016 | | [KB4011026](https://patchblox.com/security/data/fix/microsoft/kb4011026.md) | Jun 12, 2018 | | Microsoft | Microsoft Office Web Apps Server 2013 Service Pack 1 | | [KB4022183](https://patchblox.com/security/data/fix/microsoft/kb4022183.md) | Jun 12, 2018 | --- Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.