This vulnerability (CVE-2026-26144) is classified as CWE-79, indicating improper neutralization of input during web page generation leading to cross-site scripting (XSS). It affects Microsoft Office Excel in Microsoft 365 Apps for Enterprise, specifically version 16.0.1. The flaw allows an unauthorized attacker to disclose information over a network by exploiting the XSS issue. The CVSS 3.1 base score is 7.5 (high), with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. Microsoft has released an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation of this vulnerability could allow an attacker to disclose sensitive information over a network due to the cross-site scripting flaw in Microsoft Excel within Microsoft 365 Apps for Enterprise. The confidentiality impact is high, but integrity and availability impacts are not affected. No privileges or user interaction are required for exploitation, increasing the risk.

An official fix is available from Microsoft. Since Microsoft 365 Apps for Enterprise is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise environment is updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26144 to protect against this vulnerability.