Security Policy Errors

How to Investigate Defender OpenSSL Vulnerability Alerts in Microsoft Office

Olivia Miller Oct 21, 2026 868 views

Question details

Users need to investigate and resolve Microsoft Defender security recommendations that falsely appear as standalone OpenSSL vulnerabilities, which are actually bundled inside other software.

How to Investigate Microsoft Defender OpenSSL Vulnerability Alerts in Office

Product: Microsoft Office
Device & OS: Windows Server
Scenario: Investigating a Microsoft Defender alert flagging vulnerable OpenSSL files to determine their source application and apply remediation.
Observed behavior: Microsoft Defender flags OpenSSL64.dll as vulnerable even when OpenSSL is not manually installed. The file is often found hidden inside the Microsoft Office installation path, specifically within Salesforce ODBC Drivers, with no immediate updates available.

Before you start

Ensure you have administrative access to the Windows Server and the Microsoft Defender Security Center to view the full file paths of the flagged vulnerabilities.

Solution 1Recommended

Identify the Bundled Application Path from the Defender Alert

Use the Defender alert details to find out exactly which application bundled the vulnerable OpenSSL DLL.

Many enterprise applications bundle OpenSSL libraries for specific functionalities. When Defender flags an OpenSSL vulnerability on a server where it wasn't explicitly installed, it is typically located within an application's subfolder.

Open Microsoft Defender Security Center

Locate the exact file path

Review the alert details to find the exact path of the flagged file. Look for paths indicating it is bundled with Office, such as C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.dll.

Verify the application source

Once the path is identified, verify if the file belongs to Microsoft Office or another third-party application installed on the server.

Identify the Bundled Application Path from the Defender Alert

Solution 2

Escalate Unpatchable Office DLLs to Microsoft Support

Since standard Microsoft Office updates may not immediately patch the bundled Salesforce ODBC OpenSSL driver, escalation is required.

Free Microsoft Office alternative

Switch to a Secure and Lightweight Office Suite

If enterprise security alerts from bundled, unpatched components in Microsoft Office are causing compliance headaches, consider switching to WPS Office. It provides a clean, bloat-free environment without bundling unnecessary legacy drivers that trigger false or unpatchable Defender alerts.

High compatibility with Microsoft Word, Excel, and PowerPoint formats.Lightweight installation without bloated third-party ODBC drivers.Lower attack surface for enterprise security and compliance.Free to download, easy to deploy, and features a highly familiar user interface.

Frequently Asked Questions

Why is Defender flagging OpenSSL when I never installed it on the server?

Many enterprise applications, including Microsoft Office, bundle their own versions of OpenSSL for specific background features (such as the Salesforce ODBC driver). Defender scans the entire drive and flags these hidden, bundled components if they are outdated.

Can I just delete the OpenSSL64.dll file from the Office folder to clear the alert?

Deleting bundled DLL files directly from the Microsoft Office directory is not recommended. Doing so may break the associated ODBC drivers, cause feature failures, or trigger automatic Office repair prompts that simply redownload the vulnerable file.

Are there Office updates available to fix the Salesforce ODBC OpenSSL vulnerability?

There is often a delay between Defender flagging a vulnerability and Microsoft releasing a patched version of a bundled third-party driver. You should check for Office updates first, but if none are available, you may need to wait for a specific patch or escalate the issue to Microsoft Support.

Microsoft Office Security Issues