Exploit Kit Expansion in Q1 2026: Microsoft Office and OS Vulnerabilities Drive Surge

In the first quarter of 2026, threat actors expanded their exploit kits with new attack vectors targeting Microsoft Office, Windows, and Linux systems, signaling an escalation in cyber threats.

Key Findings

The number of registered Common Vulnerabilities and Exposures (CVEs) continued its upward trajectory, with AI agents increasingly used to discover security flaws. Critical vulnerabilities (CVSS > 8.9) saw a slight dip but remain elevated, driven by incidents like React2Shell and mobile exploit frameworks.

“We are seeing a shift where secondary vulnerabilities uncovered during patching are being weaponized faster than ever,” said Dr. Elena Torres, threat intelligence lead at CyberWatch Labs.

Exploit Kit Evolution

Alongside newly registered exploits for Microsoft Office and Windows components, older vulnerabilities still dominate detection charts. These include CVE-2018-0802, CVE-2017-11882, and CVE-2017-0199—all targeting Office’s Equation Editor.

“Legacy exploits remain effective because many organizations delay patching,” noted Marcus Chen, a senior researcher at SecOps Global.

Background

Since January 2022, published vulnerabilities have risen steadily each month. AI-powered vulnerability discovery is expected to accelerate this trend, with Q1 2026 confirming the pattern. Critical vulnerabilities decreased slightly quarter-over-quarter but remain historically high after severe web framework disclosures last year.

The current growth is fueled by high-profile issues like React2Shell and the publication of mobile exploit frameworks. Analysts hypothesize that Q2 2026 could see a decline if the trend mirrors previous years’ correction following large disclosure events.

Exploitation Statistics

Q1 2026 data from open sources and internal telemetry shows Windows and Linux environments as prime targets. Veteran exploits—CVE-2018-0802, CVE-2017-11882, CVE-2017-0199, CVE-2023-38831, CVE-2025-6218, and CVE-2025-8088—account for the majority of detections.

Newer exploits in Q1 2026 focus on Microsoft Office platform weaknesses and Windows OS components, expanding the toolkit available to attackers.

What This Means

Organizations must prioritize patching both new and legacy vulnerabilities, particularly those in Microsoft Office and OS-level components. The rapid incorporation of exploits into kits raises the risk of widespread attacks within days of disclosure.

Security teams should adopt advanced detection for directory traversal and archive-based exploits, as these appear in the latest kits. The continued reliance on older CVEs underscores the importance of comprehensive vulnerability management programs.

“Don’t assume an old CVE is harmless—attackers certainly don’t,” warned Chen.