Old Microsoft Excel flaw CVE-2009-0238 added to CISA's exploited list; fixed since 2009 (MS09-009)
CISA added a 2009 Excel flaw (CVE-2009-0238) to its list of flaws used in attacks on 14 April 2026. Opening a booby-trapped Excel file can let an attacker run code. Microsoft fixed it in 2009, so only very old, unsupported Office needs action: upgrade it.
If anyone in the family or business still runs Office 2007 or older, or Office for Mac 2004 or 2008, move to a supported version of Microsoft 365 or Office. Don't open unexpected Excel files from email or messages.
What’s happening
On 14 April 2026 the US cyber agency CISA added CVE-2009-0238, a remote code execution flaw in Microsoft Excel, to its Known Exploited Vulnerabilities list, which confirms the flaw is being used in attacks. An attacker can take control of a computer if the user opens a specially crafted Excel file containing a malformed object. Microsoft fixed the flaw in April 2009 through bulletin MS09-009. The affected software is very old: Excel 2000, 2002, 2003 and 2007 (with the service packs listed), Excel Viewer, the Office 2007 Compatibility Pack, and Excel for Mac 2004 and 2008. The Register reports that CISA did not say who is exploiting it or how, and gave federal agencies two weeks to fix it. The Register also says Microsoft first saw it used by a malware loader called Trojan.Mdropper.AC in 2009. CISA's catalogue entry lists a severity score of 8.8, while The Register reports 9.3. Anyone on a currently supported version of Microsoft Office is not affected by the fix gap, and should not open unexpected Excel attachments.
- What
- Flaw
- Affects
- Microsoft Excel and Office (2000 to 2007, Excel Viewer, Office for Mac 2004 and 2008)
- Affected
- Microsoft Office Excel 2000 SP3
Microsoft Office Excel 2002 SP3
Microsoft Office Excel 2003 SP3
Microsoft Office Excel 2007 SP1
Microsoft Office Excel Viewer 2003 Gold and SP3
Microsoft Office Excel Viewer
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1
Microsoft Office 2004 for Mac
Microsoft Office 2008 for Mac - Fixed in
- Security updates released in Microsoft bulletin MS09-009 (14 April 2009)
- Since
- 14 Apr 2026
- Closed
- 14 Apr 2026
Timeline
- CISA added
CISA added CVE-2009-0238 to its Known Exploited Vulnerabilities list, confirming attacks. Federal civilian agencies were given two weeks to apply the fix, a week less than usual. CISA did not say who is exploiting it or how.
- Made publicFixed
Microsoft published bulletin MS09-009 rated Critical, with security updates for CVE-2009-0238, an Excel flaw triggered by opening a specially crafted file. Affected products include Excel 2000 to 2007 and Excel for Mac 2004 and 2008.
Sources
- Microsoft Security Bulletin MS09-009 - CriticalMicrosoft · 14 Apr 2009
- Ancient Excel bug comes out of retirement for active attacksThe Register · 15 Apr 2026