Sophos cloud endpoint: Multiple users getting "Caller Check Exploit Prevented in Microsoft Excel" when using custom spreadsheets

I have to day received the callercheck message attempting to connect to a SQL server using excel 2016

I have the latest client 11.5.4

Has anyone found a fix yet?

Thanks

On Office 2016, 64 bit, the error does not happen, at least on the limited amount of machines that we have running 64 bit.  Everyone on 32 bit Office has the issue.  There are considerations that you need to know about when running 64 bit.  See this article:  

https://support.office.com/en-us/article/Choose-between-the-64-bit-or-32-bit-version-of-Office-2dee7807-8f95-4d0c-b5fe-6c6f49b8d261?ui=en-US&rs=en-US&ad=US

-Rick

Thanks for Update Rick -- Will give this a run on one of our machines - and see if all is the same as you - would be super if this works - (Thanks Sophos.....NOT)

Rather than replace all your 64-bit versions of Excel with 32-bit versions or vice versa (we only have 64 bit and have the same problems), you could put in an exploit mitigation exclusion until Sophos release an update to address this. I have been told several times that this is in the works but neither the release notes from the past two months nor the feedback here suggest that current versions are able to distinguish this acceptable traffic from anomalous malicious traffic. We use an app called Axiom EPM that was the first one that brought this to our attention but whitelisting its EXEs and directories were sufficient until some of our business analysts started working with Microsoft Power Query for Excel. You may wish to follow up with your account manager in reference to bug ID WINEP-6445.

Rather than replace all your 64-bit versions of Excel with 32-bit versions or vice versa (we only have 64 bit and have the same problems), you could put in an exploit mitigation exclusion until Sophos release an update to address this. I have been told several times that this is in the works but neither the release notes from the past two months nor the feedback here suggest that current versions are able to distinguish this acceptable traffic from anomalous malicious traffic. We use an app called Axiom EPM that was the first one that brought this to our attention but whitelisting its EXEs and directories were sufficient until some of our business analysts started working with Microsoft Power Query for Excel. You may wish to follow up with your account manager in reference to bug ID WINEP-6445.