This vulnerability (CVE-2025-21346) in Microsoft 365 Apps for Enterprise involves a failure in protection mechanisms (CWE-693), enabling a security feature bypass. The CVSS 3.1 score is 7.1 (high severity) with attack vector local, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity and availability impact, and official remediation available. The vendor advisory confirms an official fix and that this is a cloud service with vendor-managed remediation.

An attacker with local access and requiring user interaction could bypass security features, resulting in high impact on the integrity and availability of the affected system. Confidentiality is not impacted. The vulnerability could allow unauthorized modification or disruption of service in Microsoft 365 Apps for Enterprise version 16.0.1.

Microsoft has released an official fix for this vulnerability. Since Microsoft 365 Apps for Enterprise is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their environments are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21346 to apply the fix.