Skip to content
October 6, 2026
  • Bluesky
  • Facebook
  • Linkedin
  • Mastodon
  • RSS
  • Twitter
  • Youtube

Daily CyberSecurity

Zero-hour alerts. Unmatched analysis.

Primary Menu
  • Home
  • CVE Data
    • CVE Watchtower
    • Top Exploited CVEs
    • CVE Stats by Vendor
    • Q2 2026 Report
    • CVE Alerts
    • CVE Alert Settings
    • Pricing
  • Cyber Criminals
  • Data Leak
  • Free Tools
    • CVSS 3.1 Calculator
    • Certificate Viewer
    • DNS Lookup
    • Encoder & Hash Generator
    • IP / Subnet Calculator
    • Whois Lookup
  • Linux
  • Malware
  • Vulnerability
  • Submit Press Release
  • Weekly Recap
Light/Dark Button
  • Home
  • News
  • Technology
  • Microsoft Blocks Flash and Silverlight in Office 365 Documents
  • Technology

Microsoft Blocks Flash and Silverlight in Office 365 Documents

Do Son May 23, 2018 1 minute read
Add Daily CyberSecurity as a preferred source on Google

Microsoft recently announced a policy update that will limit the use of Flash, Shockwave, and Silverlight controls in Office 365. As Tom Gallagher, manager of the Microsoft Office Security Engineering team, points out, the content will be blocked from activating in Office. Specifically, the software giant stated that because Flash, Shockwave, and Silverlight are still used for vulnerability activities against Office users, and the user base of these controls is shrinking, restrictions will be imposed.

By the end of 2020, Adobe will also end its support for Flash. Silverlight also expects to reach the end of support in 2021. Technically speaking, Flash and Silverlight content in Office 365 documents will no longer be enabled once this decision takes effect. This policy does not affect Office 2016, Office2013, or Office 2010.

Microsoft said that this change does not include the activation of these controls outside of the Office process. For example, inserting Flash video into a document by inserting an online video feature. Microsoft will still allow customers to open controls based on their true needs, and the company provides specific guidance in this area. However, this is not recommended because this decision involves multiple security factors and preventing Flash can help prevent some system-specific attacks.

Related coverage

  • Speeding Up the Web: Chrome 148 Extends “Lazy Loading” to Video and Audio Tags
  • Agentic War: Amazon Secures Landmark Injunction to Block Perplexity’s AI Shopping Bot
  • Google Ask Photos Relaunches: AI-Powered Search Now Faster, Smarter & Back for US Users
  • Grok 4 Unleashed: xAI’s Next-Gen AI Model Takes on OpenAI & Google
  • WhatsApp on Windows 11 Ditches Native UWP for WebView2: Performance Takes a Hit
  • Intel Introduces Wi-Fi Standard 802.11ax Chipset: Up to 40% Faster
Track all actively exploited CVEs →

Support Our Threat Intelligence

Find our tech and OS security coverage helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee Logo Buy Me a Coffee
Select your plan
Free Pro Team

Hover over a plan to see its benefits.

Get Zero-Hour Vulnerability Alerts

Critical CVEs, CVSS scores, and PoC updates — straight to your inbox every week.

We respect your inbox. Unsubscribe anytime.

SHARE
Share on FacebookShare on XShare on LinkedInShare on TelegramShare on BlueskyShare on Mastodon
Written by
@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.

Tags: Blocks Flash

Search

Translation

CVE ALERTS
📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

Subscribe – $7/mo or try free for 14 days →

🚨 Active Exploits in the Wild

  • CVE-2026-88779CVSS 8.7
    Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS,...
    Admin intelCISA KEV📅 Added to KEV: Oct 4, 2026📅 Updated: Oct 4, 2026
  • CVE-2026-102490CVSS 8.5
    All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.
    Admin intelCISA KEV📅 Added to KEV: Oct 2, 2026📅 Updated: Oct 2, 2026
  • CVE-2026-102489CVSS 8.7
    Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as...
    Admin intelCISA KEV📅 Added to KEV: Oct 2, 2026📅 Updated: Oct 2, 2026
  • CVE-2026-100382CVSS 10.0
    Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\') vulnerability in Wikimedia Foundation Mediawiki...
    Admin intel📅 Updated: Oct 1, 2026
  • CVE-2026-104286CVSS 9.8
    An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through...
    CISA KEV📅 Added to KEV: Oct 1, 2026
  • CVE-2026-76504CVSS 9.8
    A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote...
    Admin intelCISA KEV📅 Added to KEV: Sep 30, 2026📅 Updated: Sep 30, 2026
  • CVE-2026-86950CVSS 8.8
    An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and...
    Admin intelCISA KEV📅 Added to KEV: Sep 29, 2026📅 Updated: Sep 29, 2026
  • CVE-2026-88772
    Memory overflow vulnerability leading to remote code execution or denial of service.
    Admin intelCISA KEV📅 Added to KEV: Sep 27, 2026📅 Updated: Sep 27, 2026
Powered by CVE Watchtower

Critical Vulnerabilities

  • CVE-2026-91107CVSS 9.3
    openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record...
    📅 Updated: Oct 6, 2026
  • CVE-2026-21589CVSS 9.3
    h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center,...
    📅 Updated: Oct 6, 2026
  • CVE-2026-86246CVSS 9.1
    Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including...
    📅 Updated: Oct 6, 2026
  • CVE-2026-91140CVSS 9.6
    An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI...
    📅 Updated: Oct 6, 2026
  • CVE-2026-105484CVSS 10.0
    A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of...
    📅 Updated: Oct 6, 2026
  • CVE-2026-105835CVSS 9.1
    PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute...
    📅 Updated: Oct 6, 2026
  • CVE-2026-82531CVSS 9.2
    Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never...
    📅 Updated: Oct 6, 2026
  • CVE-2025-12543CVSS 9.6
    A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and...
    📅 Updated: Oct 6, 2026
Powered by CVE Watchtower

Daily CyberSecurity

  • About SecurityOnline.info
  • Advertise with us
  • Announcement
  • Contact
  • Contributor Register
  • Login
  • Disclaimer
  • DCMA
  • Privacy Policy
  • About SecurityOnline.info
  • Advertise on SecurityOnline.info
  • Contact Us

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works

  • CVE Watchtower
  • CVE Statistics by Vendor 2026
  • Q2 2026 Report
  • Top Exploited CVEs
  • Bluesky
  • Facebook
  • Linkedin
  • Mastodon
  • RSS
  • Twitter
  • Youtube
© 2017 - 2026 Daily CyberSecurity. All Rights Reserved.