EIP-2026-118524

This HTML-based exploit leverages the Excel Viewer OCX 3.2 ActiveX control (CLSID: {18A295DA-088E-42D1-BE31-5028D7F9B965}) to execute a remote file via the OpenWebFile method. The exploit is triggered by a button click, which fetches and executes a malicious payload (calc.exe) from a remote server.