This vulnerability (CVE-2026-21258) in Microsoft 365 Apps for Enterprise arises from improper input validation in Microsoft Office Excel. It allows an unauthorized attacker to disclose information on the local system. The CVSS 3.1 base score is 5.5 (medium), with an attack vector of local access, low attack complexity, no privileges required, and user interaction needed. The confidentiality impact is high, while integrity and availability are unaffected. Microsoft has released an official fix and manages remediation for this cloud service. No known exploits are reported in the wild.

An attacker with local access and the ability to trick a user into interacting with a malicious input could gain unauthorized disclosure of sensitive information. There is no impact on data integrity or system availability. The vulnerability does not require elevated privileges but does require user interaction. No active exploitation has been reported.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21258 to mitigate this vulnerability.