This vulnerability (CVE-2026-20949) in Microsoft Office Excel within Microsoft 365 Apps for Enterprise is classified as CWE-284 (Improper Access Control). It permits a local attacker without privileges to bypass a security feature, potentially leading to high impact on confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.8, reflecting high severity with local attack vector, low attack complexity, no privileges required, and user interaction needed. Microsoft has published an official fix and manages remediation for this cloud service. The affected version explicitly identified is 16.0.1.

Successful exploitation allows an unauthorized local attacker to bypass security controls in Microsoft Excel, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system or data. The CVSS score of 7.8 indicates a high impact on security properties. No known active exploits have been reported.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated to the patched version as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20949. No additional mitigation actions are indicated by the vendor.