Microsoft Publisher CVE-2024-38226: Macro Policy Bypass

What to do

1. Inventory every Windows machine that still has Publisher (MSPUB.EXE) installed.
2. Confirm Publisher 2016 has KB5002566 or later and Click-to-Run Office 2019/LTSC 2021 is on a September 2024 or newer build.
3. Convert needed .pub files to PDF or Word, then uninstall Publisher; perpetual support ended October 13, 2026.
4. Enforce the 'Block macros from running in Office files from the Internet' policy for Publisher and every other Office app.
5. Block or quarantine inbound .pub attachments at the mail gateway.

How to check if you are affected or compromised

• Search EDR telemetry for MSPUB.EXE spawning cmd.exe, powershell.exe, wscript.exe, mshta.exe or rundll32.exe.
• Search mail and proxy logs for .pub files received from outside the organization before each host took the September 2024 update.
• On hosts that opened external .pub files while unpatched, review Run keys, scheduled tasks, services and new outbound connections.

What happened#

On September 10, 2024, Microsoft fixed CVE-2024-38226, a security feature bypass in Microsoft Publisher. Microsoft marked it "Exploitation Detected", and CISA added it to the KEV catalog the same day. According to Microsoft, an attacker "could bypass Office macro policies used to block untrusted or malicious files." The attack needs a victim to download and open a crafted file. The Preview Pane is not an attack vector. Microsoft scores it CVSS 3.1 7.3 (local vector, user interaction required).

Microsoft did not credit a finder or describe the attacks. BleepingComputer noted that Microsoft did not share how it was exploited. As of Oct 23, 2026, no actor or campaign has been publicly tied to it.

The bypassed control matters. Since February 2023, Microsoft 365 Apps has blocked VBA macros by default in Publisher files from the internet (files carrying Mark of the Web), and admins can enforce the same block by policy. A bypass of that kind of policy brings back the classic macro-laden phishing attachment.

Who is affected#

Microsoft's update data lists three products:

• Publisher 2016 (MSI), fixed by KB5002566 (build 16.0.5465.1001).
• Office 2019 (Click-to-Run), fixed by the September 2024 security update.
• Office LTSC 2021 (Click-to-Run), fixed by the same update.

Microsoft 365 Apps is not on the list.

The product is also gone now. Publisher 2016 and 2019 reached end of support on October 14, 2025. Microsoft says Publisher reached end of life in October 2026. Microsoft 365 subscribers lose access on or shortly after October 1, 2026, and support for perpetual versions ended October 13, 2026.

Do you really need to act?#

Not urgently for the CVE itself. It needs a user to open a malicious Publisher file, and the fix has been out for more than two years. The bigger issue today is that any Publisher still installed receives no further security updates. Whatever the next Publisher bug is, it will never be patched, and .pub attachments remain a phishing lure. So treat this as an inventory-and-retire job, not a patch job.

What to do now#

1. Find installs: Get-ChildItem 'C:\Program Files*\Microsoft Office' -Recurse -Filter MSPUB.EXE -ErrorAction SilentlyContinue | Select-Object FullName, @{n='Ver';e={$_.VersionInfo.FileVersion}}, or query your software inventory for Publisher.
2. Confirm the fix. For Click-to-Run, run Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' | Select-Object VersionToReport and check that it is a September 2024 or later build. For Publisher 2016 MSI, check Installed Updates for KB5002566 or a later Publisher update.
3. Have users save needed .pub files as PDF or Word (File > Save as), then uninstall Publisher.
4. Enforce "Block macros from running in Office files from the Internet" under Microsoft Publisher 2016\Publisher Options\Security\Trust Center (and the equivalent for Word, Excel and the others) through Group Policy, Intune or Cloud Policy.
5. Block or quarantine inbound .pub attachments at the mail gateway.

How to tell if you were hit#

No public indicators exist for this exploit. Hunt on behavior instead. Query EDR for MSPUB.EXE spawning cmd.exe, powershell.exe, wscript.exe, mshta.exe or rundll32.exe. Then check mail and proxy logs for .pub files from external senders that reached hosts before they took the September 2024 update. On any such host, review persistence (Run keys, scheduled tasks, services) and new outbound connections.

Timeline#

• Feb 14, 2023 — Microsoft 365 Apps starts blocking macros by default in Publisher files from the internet.
• Sep 10, 2024 — Microsoft fixes CVE-2024-38226 with exploitation detected. CISA adds it to KEV.
• Oct 1, 2024 — CISA's remediation deadline for federal agencies.
• Oct 14, 2025 — Publisher 2016 and 2019 reach end of support.
• Oct 13, 2026 — Support for perpetual Publisher ends. Microsoft 365 access ended on or after Oct 1.

Vulnerability records

• CVE-2024-38226 · KEV 2024-09-10 · Microsoft Publisher Security Feature Bypass Vulnerability

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft — Security Update Guide: CVE-2024-38226 msrc.microsoft.com
2. Microsoft — September 2024 Security Updates (CVRF) api.msrc.microsoft.com
3. CVE record — CVE-2024-38226 cve.org
4. NVD — CVE-2024-38226 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2024-38226 cisa.gov
6. Microsoft Learn — Macros from the internet are blocked by default in Office learn.microsoft.com
7. Microsoft Support — Microsoft Publisher will no longer be supported after October 2026 support.microsoft.com
8. Microsoft Learn — Ending Support in 2025 learn.microsoft.com

Coverage and analysis

1. BleepingComputer — Microsoft September 2024 Patch Tuesday fixes 4 zero-days, 79 flaws bleepingcomputer.com