[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEMa07aUdw3pN0pmluNwMYo8zhpZRxgHazpr3yaFzg4M":3},{"article":4,"iocs":44,"watch_terms":52,"solutions":53,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"a7504786-7305-40a6-9310-0714830db205","LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings","libreoffice-and-openoffice-flaws-let-malicious-spreadsheets-run-code-without-mac-0d2a51","A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either program shows before it runs a macro. The attack works only when the program's Java support is enabled. So far, it has only been shown as a proof of concept, and there are no reports of its use in","Security researchers have demonstrated a vulnerability in LibreOffice and Apache OpenOffice that allows malicious spreadsheets to execute arbitrary attacker code without any user warning, provided Java support is enabled. LibreOffice has released a fix, tracked as CVE-2026-63277, while Apache OpenOffice, affected by CVE-2026-59265, expects a fix in a future release. The attack leverages the 'database range' feature to pull in and execute code from a remote ODB file, bypassing macro security prompts.","LibreOffice and OpenOffice spreadsheets can execute attacker code without user warning if Java is enabled.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Flibreoffice-and-openoffice-flaws-let.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjYVdFxWk-OP9_vpIdzp0S9ffqMNnyAMbRWKklSryVockcistDlpX5ZcfLGluaqpHqdsu_DoOaFq2J1z5jTVNatxS8aoQjMNS1PoEYOAZrj1V1Spdk67LUZgSlSPlqeEULSVSbHZfkCimWV56E2HKs_IUNrJaYFrPPq0YaXS2sEMBVZNJM0f2ydfUMFREw\u002Fs1600\u002Foffice-sheet.jpg","2026-10-06T11:57:00+00:00","2026-10-06T12:00:14.925646+00:00",8,[17,20,22,25,27,29],{"name":18,"type":19},"LibreOffice","product",{"name":21,"type":19},"Apache OpenOffice",{"name":23,"type":24},"Java","technology",{"name":26,"type":24},"JDBC",{"name":28,"type":19},"ODB",{"name":30,"type":19},"JAR","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[45,49],{"type":46,"value":47,"context":48},"cve","CVE-2026-63277","LibreOffice vulnerability allowing code execution via spreadsheets",{"type":46,"value":50,"context":51},"CVE-2026-59265","Apache OpenOffice vulnerability allowing code execution via spreadsheets",[18,21,28],{"controls":54,"vendors":138},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"patch-management","Automated patch management","Known holes get closed in days, not months.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":85,"name":86,"problem":87,"products":88},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":114,"name":115,"problem":116,"products":117},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[118,125,132],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":114,"product_name":122,"url":123,"description":124},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":126,"product_name":129,"url":130,"description":131},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":133,"product_name":134,"url":136,"description":137},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":155},"malicious-spreadsheets-exploit-libreoffice-openoffice-to-run-code-silently","Malicious Spreadsheets Exploit LibreOffice & OpenOffice to Run Code Silently","A critical vulnerability in LibreOffice and Apache OpenOffice allows attackers to execute arbitrary code through maliciously crafted spreadsheets by abusing the 'database range' feature to load and run code from remote ODB files — all without triggering macro security warnings. The root problem lies in insufficient input validation and a failure to apply macro security controls consistently across all code execution pathways, not just traditional macros. LibreOffice has issued a patch (CVE-2026-63277), but Apache OpenOffice has no fix available yet, leaving a large portion of the user base exposed. This matters because office productivity suites are ubiquitous in enterprise environments, and silent code execution bypassing security prompts dramatically lowers the bar for successful phishing and document-based attacks.",[144,145,146,147,148,149,150,151,152,153,154],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 SI-3: Malicious Code Protection","NIST CSF ID.VM-1: Vulnerabilities are identified and documented","MITRE ATT&CK T1204.002: User Execution – Malicious File","MITRE ATT&CK T1059: Command and Scripting Interpreter",{}]