This vulnerability (CVE-2026-26144) is classified as CWE-79, indicating improper neutralization of input during web page generation in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise version 16.0.1. The flaw allows an attacker to perform cross-site scripting attacks that can lead to unauthorized information disclosure over a network. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects that the attack can be performed remotely without privileges or user interaction, with high confidentiality impact but no integrity or availability impact. The vulnerability is published and a patch is available, though no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to disclose sensitive information remotely without requiring user interaction or privileges. The confidentiality impact is high, but the integrity and availability of the affected system are not impacted. There are no known active exploits in the wild at this time.

A patch is available for this vulnerability. Users and administrators should apply the official update from Microsoft for Microsoft 365 Apps for Enterprise version 16.0.1 to remediate this issue. Since this is not a cloud service, remediation depends on applying the patch. No additional mitigation steps are indicated by the vendor advisory.