This vulnerability (CVE-2026-21260) in Microsoft 365 Apps for Enterprise allows unauthorized attackers to gain access to sensitive information via Microsoft Office Outlook, facilitating spoofing attacks over a network. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with high confidentiality impact but no integrity or availability impact. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). Microsoft has released an official fix and manages remediation for this cloud service as detailed in their advisory.

The vulnerability exposes sensitive information to unauthorized actors, potentially allowing spoofing attacks that could mislead users or systems. The confidentiality impact is high, but there is no direct impact on data integrity or system availability. No known exploits are currently active in the wild.

An official fix is available from Microsoft, and remediation is managed by the vendor for this cloud-hosted service. Users and administrators should apply the official updates as provided in the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21260 to mitigate this vulnerability.