CVE-2025-21365 is a vulnerability classified under CWE-426 (Untrusted Search Path) affecting Microsoft 365 Apps for Enterprise version 16.0.1. This flaw could allow remote code execution due to the application loading code or libraries from an untrusted path. The CVSS v3.1 base score is 7.8, indicating high severity with attack vector local, low attack complexity, no privileges required, and user interaction required. The vulnerability impacts confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21365.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely, potentially leading to full compromise of the affected Microsoft 365 Apps for Enterprise environment. The impact includes complete loss of confidentiality, integrity, and availability of the affected system. However, exploitation requires local access and user interaction.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21365 to ensure their environments are updated and protected.