CISA Flags 17-Year-Old Excel Vulnerability Amid Active Exploitation

CISA added a critical 2009 Excel flaw to its exploited vulnerabilities list due to active attacks.

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2009-3129—a critical Excel vulnerability discovered 17 years ago—to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation as of April 13, 2026.

• The bug is an out-of-bounds write issue in Microsoft Excel's FEATHEADER record parsing, potentially allowing remote code execution when a user opens a specially crafted Excel file.
• Microsoft patched CVE-2009-3129 in November 2009 under security bulletin MS09-067, but the recent wave of attacks signals that many systems may still be vulnerable.

For legal organizations, the warning is clear: even well-aged vulnerabilities can be reweaponized. CISA stated, "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise." The risk extends to private law firms and in-house counsel who regularly handle sensitive data.

The KEV Catalog is a continuously updated list highlighting actively exploited threats that demand urgent remediation. Firms should inventory their software, confirm patch status for legacy applications, and act swiftly if gaps remain.

Failure to patch old solutions, even those thought safe, can put critical corporate and client data at risk of compromise.

Yes, but: Current exploitation methods and the scale of attacks remain unclear, limiting risk assessment specificity.