Question: We received a note from the security review team highlighting a CRUD/FLS vulnerability in our package and in the note it says there is a "Instances of SELECT vulnerability found across the application".

An example provided is shown below in a "with sharing" class:

> 
> myAttachments = [SELECT name, id, parentid, CreatedDate,CreatedById FROM Attachment WHERE parentid=:myAccount.id];
> 
> 
> 

If the user does not have access to the object or the field, the result will be null. So the FLS must be enforced.

The documentation [here](https://developer.salesforce.com/page/Enforcing_CRUD_and_FLS) does not specify the issue. How can we resolve this issue?

Answer: 
I contacted Salesforce's Support team and they provided [this article](https://support.microsoft.com/en-us/kb/2994633) as a temporary fix. 

They also mentioned: 

> 
> "Our R&D team has investigated this matter and logged a New Issue for it to be repaired. Unfortunately, I cannot provide a timeline as to when this repair will be implemented due to Safe Harbor constraints."
> 
> 
> 

[Salesforce Known Issue](https://success.salesforce.com/issues_view?id=a1p3A000000IZSEQA4)
Is KB3115322 (Security Update for Excel 2010) installed? If so, uninstalling this update worked for us. I notified Salesforce about the problem so that either Salesforce or Microsoft fixes the issue, since the update is flagged as critical by Microsoft.

It's KB3115262 related to Excel 2013.
It's KB3115272 related to Excel 2016.